fix(ci): grant secret-scanner caller the permissions its reusable requests - #63
Merged
Merged
Conversation
…uests The gitleaks job inside standards' secret-scanner-reusable requests pull-requests: write + actions: read; a called reusable workflow cannot escalate past the caller's grant, so the whole run died at startup (same class as the scorecard fix in #61, missed for this workflow). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
hyperpolymath
enabled auto-merge (squash)
July 2, 2026 04:11
hyperpolymath
added a commit
that referenced
this pull request
Jul 2, 2026
…#64) Last red on Secret Scanner after #63: the SHA-pinned trufflehog action (v3.95.6) injects `--fail` internally, so the repo job's `extra_args: --only-verified --fail` dies with `flag 'fail' cannot be repeated` (the old unpinned `@main` predated the injection). `--results=verified` replaces the deprecated `--only-verified`; fail-on-verified-findings behavior is unchanged. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Secret Scanner was the last
startup_failureon main: the gitleaks job insecret-scanner-reusablerequestspull-requests: write+actions: read, and a called reusable workflow cannot escalate past the caller's grant. Same mechanism as the scorecard fix in #61 — this caller was missed because it wasn't among the sampled failing runs. One-line permissions grant.🤖 Generated with Claude Code