From 1004b299ac82c86e0979d7c64f97311a3c0381fe Mon Sep 17 00:00:00 2001 From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com> Date: Thu, 2 Jul 2026 05:10:37 +0100 Subject: [PATCH] fix(ci): grant secret-scanner caller the permissions its reusable requests The gitleaks job inside standards' secret-scanner-reusable requests pull-requests: write + actions: read; a called reusable workflow cannot escalate past the caller's grant, so the whole run died at startup (same class as the scorecard fix in #61, missed for this workflow). Co-Authored-By: Claude Fable 5 --- .github/workflows/secret-scanner.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index fff4433..e78e89e 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -8,8 +8,13 @@ on: concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true +# The called reusable's gitleaks job requests pull-requests:write + +# actions:read (PR summary comments); a called workflow cannot escalate +# past the caller's grant, so they must be granted here. permissions: contents: read + pull-requests: write + actions: read jobs: scan: uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@a44c93a5cd3d293ee3e8b488444dcdc19c4e5d49