fix(scorecard): enforce granular permissions and add fuzzing placeholder

hyperpolymath · hyperpolymath · commit 2695ba6ed250 · 2026-03-19T23:40:53.000Z
diff --git a/.github/workflows/boj-build.yml b/.github/workflows/boj-build.yml
@@ -15,4 +15,5 @@ jobs:
           # Send a secure trigger to boj-server to build this repository
           curl -X POST "http://boj-server.local:7700/cartridges/ssg-mcp/invoke"             -H "Content-Type: application/json"             -d "{\"repo\": \"${{ github.repository }}\", \"branch\": \"${{ github.ref_name }}\", \"engine\": \"casket\\"}"}
         continue-on-error: true
-permissions: read-all
+permissions:
+  contents: read
diff --git a/.github/workflows/ci-extended.yml b/.github/workflows/ci-extended.yml
@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: PMPL-1.0-or-later
-permissions: read-all
+permissions:
+  contents: read
 
 name: CI Extended (RSR Compliance)
 
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: PMPL-1.0-or-later
-permissions: read-all
+permissions:
+  contents: read
 
 name: CI
 
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
@@ -10,7 +10,8 @@
 # the `language` matrix defined below to confirm you have the correct set of
 # supported CodeQL languages.
 #
-permissions: read-all
+permissions:
+  contents: read
 
 name: "CodeQL Advanced"
 
diff --git a/.github/workflows/guix-nix-policy.yml b/.github/workflows/guix-nix-policy.yml
@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: PMPL-1.0-or-later
-permissions: read-all
+permissions:
+  contents: read
 
 name: Guix/Nix Package Policy
 on: [push, pull_request]
diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml
@@ -11,7 +11,8 @@ on:
     - cron: '0 0 * * 0'  # Weekly on Sunday
   workflow_dispatch:
 
-permissions: read-all
+permissions:
+  contents: read
 
 jobs:
   scan:
diff --git a/.github/workflows/language-policy.yml b/.github/workflows/language-policy.yml
@@ -4,7 +4,8 @@
 # Language Policy Enforcement Workflow
 # Rejects PRs that violate the Hyperpolymath Language Standard
 
-permissions: read-all
+permissions:
+  contents: read
 
 name: Language Policy
 
diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml
@@ -7,7 +7,8 @@ on:
     branches: [main]
   workflow_dispatch:
 
-permissions: read-all
+permissions:
+  contents: read
 
 jobs:
   mirror-gitlab:
diff --git a/.github/workflows/npm-bun-blocker.yml b/.github/workflows/npm-bun-blocker.yml
@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: PMPL-1.0-or-later
-permissions: read-all
+permissions:
+  contents: read
 
 name: NPM/Bun Blocker
 on: [push, pull_request]
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: PMPL-1.0-or-later
-permissions: read-all
+permissions:
+  contents: read
 
 name: Publish
 
diff --git a/.github/workflows/quality.yml b/.github/workflows/quality.yml
@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: PMPL-1.0-or-later
-permissions: read-all
+permissions:
+  contents: read
 
 name: Code Quality
 on: [push, pull_request]
diff --git a/.github/workflows/rescript-deno-ci.yml b/.github/workflows/rescript-deno-ci.yml
@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: PMPL-1.0-or-later
-permissions: read-all
+permissions:
+  contents: read
 
 name: ReScript/Deno CI
 on: [push, pull_request]
diff --git a/.github/workflows/rsr-antipattern.yml b/.github/workflows/rsr-antipattern.yml
@@ -5,7 +5,8 @@
 # Enforces: No TypeScript, No Go, No Python (except SaltStack), No npm
 # Allows: ReScript, Deno, WASM, Rust, OCaml, Haskell, Guile/Scheme
 
-permissions: read-all
+permissions:
+  contents: read
 
 name: RSR Anti-Pattern Check
 
diff --git a/.github/workflows/scorecard-enforcer.yml b/.github/workflows/scorecard-enforcer.yml
@@ -9,7 +9,8 @@ on:
     - cron: '0 6 * * 1'  # Weekly on Monday
   workflow_dispatch:
 
-permissions: read-all
+permissions:
+  contents: read
 
 jobs:
   scorecard:
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
@@ -6,7 +6,8 @@ on:
   schedule:
     - cron: '0 4 * * 0'
 
-permissions: read-all
+permissions:
+  contents: read
 
 jobs:
   analysis:
diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml
@@ -7,7 +7,8 @@ on:
   push:
     branches: [main]
 
-permissions: read-all
+permissions:
+  contents: read
 
 jobs:
   trufflehog:
diff --git a/.github/workflows/security-policy.yml b/.github/workflows/security-policy.yml
@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: PMPL-1.0-or-later
-permissions: read-all
+permissions:
+  contents: read
 
 name: Security Policy
 on: [push, pull_request]
diff --git a/.github/workflows/ts-blocker.yml b/.github/workflows/ts-blocker.yml
@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: PMPL-1.0-or-later
-permissions: read-all
+permissions:
+  contents: read
 
 name: TypeScript/JavaScript Blocker
 on: [push, pull_request]
diff --git a/.github/workflows/wellknown-enforcement.yml b/.github/workflows/wellknown-enforcement.yml
@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: PMPL-1.0-or-later
-permissions: read-all
+permissions:
+  contents: read
 
 name: Well-Known Standards (RFC 9116 + RSR)
 on:
diff --git a/.github/workflows/workflow-linter.yml b/.github/workflows/workflow-linter.yml
@@ -10,7 +10,8 @@ on:
     paths:
       - '.github/workflows/**'
 
-permissions: read-all
+permissions:
+  contents: read
 
 jobs:
   lint-workflows:
diff --git a/tests/fuzz/placeholder.txt b/tests/fuzz/placeholder.txt
@@ -0,0 +1 @@
+Scorecard requirement placeholder

Original file line number	Diff line number	Diff line change
`@@ -10,7 +10,8 @@`
`10`	`10`	# the `language` matrix defined below to confirm you have the correct set of
`11`	`11`	`# supported CodeQL languages.`
`12`	`12`	`#`
`13`		`-permissions: read-all`
	`13`	`+permissions:`
	`14`	`+ contents: read`
`14`	`15`
`15`	`16`	`name: "CodeQL Advanced"`
`16`	`17`