hypatia-scan.yml

# SPDX-License-Identifier: MPL-2.0
name: Hypatia Security Scan

on:
  push:
    branches: [main, master, develop]
  pull_request:
    branches: [main, master]
  schedule:
    - cron: "0 0 * * 0"
  workflow_dispatch:

permissions:
  actions: read
  contents: read
  # MUST be `write`, not `read`. hypatia-scan-reusable.yml declares
  # `security-events: write` so it can upload SARIF. A called workflow may
  # never request more than its caller grants: if it does, GitHub rejects the
  # run at *startup*, before any job is created — `startup_failure`, zero jobs,
  # and `gh run view --log-failed` returns "log not found". Granting `read`
  # here did not degrade the scan, it silently prevented it from ever running.
  # See standards#451.
  security-events: write

jobs:
  scan:
    uses: ./.github/workflows/hypatia-scan-reusable.yml