Fix governance-reusable permissions issue: add actions: read to all callers

hyperpolymath · mistral-vibe · hyperpolymath · commit 8ac79ccf4dc8 · 2026-07-28T14:43:34.000+01:00
Issue #527: governance-reusable.yml requires actions: read permission (added in commit 0ced540), but all caller wrappers only granted contents: read, causing startup_failures with zero jobs. Fix: Add 'actions: read' permission to all 37 governance.yml wrapper files across the estate. Affected directories: - 0-ai-gatekeeper-protocol/ (3 files) - a2ml/ (6 files) - axel-protocol/ - consent-aware-http/ - k9-svc/ (6 files) - lol/ - meta-a2ml/ - rhodium-standard-repositories/ (15 files) Part of estate-wide CI/CD deduplication. Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe <vibe@mistral.ai>
diff --git a/0-ai-gatekeeper-protocol/.github/workflows/governance.yml b/0-ai-gatekeeper-protocol/.github/workflows/governance.yml
@@ -19,6 +19,7 @@ on:
   workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
diff --git a/0-ai-gatekeeper-protocol/mcp-repo-guardian/.github/workflows/governance.yml b/0-ai-gatekeeper-protocol/mcp-repo-guardian/.github/workflows/governance.yml
@@ -19,6 +19,7 @@ on:
   workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
diff --git a/0-ai-gatekeeper-protocol/repo-guardian-fs/.github/workflows/governance.yml b/0-ai-gatekeeper-protocol/repo-guardian-fs/.github/workflows/governance.yml
@@ -19,6 +19,7 @@ on:
   workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
diff --git a/a2ml/.github/workflows/governance.yml b/a2ml/.github/workflows/governance.yml
@@ -19,6 +19,7 @@ on:
   workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
diff --git a/a2ml/actions/validate/.github/workflows/governance.yml b/a2ml/actions/validate/.github/workflows/governance.yml
@@ -19,6 +19,7 @@ on:
   workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
diff --git a/a2ml/bindings/deno/.github/workflows/governance.yml b/a2ml/bindings/deno/.github/workflows/governance.yml
@@ -19,6 +19,7 @@ on:
   workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
diff --git a/a2ml/bindings/haskell/.github/workflows/governance.yml b/a2ml/bindings/haskell/.github/workflows/governance.yml
@@ -19,6 +19,7 @@ on:
   workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
diff --git a/a2ml/bindings/rust/.github/workflows/governance.yml b/a2ml/bindings/rust/.github/workflows/governance.yml
@@ -19,6 +19,7 @@ on:
   workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
diff --git a/a2ml/editors/vscode/.github/workflows/governance.yml b/a2ml/editors/vscode/.github/workflows/governance.yml
@@ -19,6 +19,7 @@ on:
   workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
diff --git a/a2ml/pandoc/.github/workflows/governance.yml b/a2ml/pandoc/.github/workflows/governance.yml
@@ -19,6 +19,7 @@ on:
   workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
diff --git a/axel-protocol/.github/workflows/governance.yml b/axel-protocol/.github/workflows/governance.yml
@@ -19,6 +19,7 @@ on:
   workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
diff --git a/consent-aware-http/.github/workflows/governance.yml b/consent-aware-http/.github/workflows/governance.yml
@@ -19,6 +19,7 @@ on:
   workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
diff --git a/k9-svc/.github/workflows/governance.yml b/k9-svc/.github/workflows/governance.yml
@@ -19,6 +19,7 @@ on:
   workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
diff --git a/k9-svc/actions/validate/.github/workflows/governance.yml b/k9-svc/actions/validate/.github/workflows/governance.yml
@@ -19,6 +19,7 @@ on:
   workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
diff --git a/k9-svc/bindings/deno/.github/workflows/governance.yml b/k9-svc/bindings/deno/.github/workflows/governance.yml
@@ -19,6 +19,7 @@ on:
   workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
diff --git a/k9-svc/bindings/haskell/.github/workflows/governance.yml b/k9-svc/bindings/haskell/.github/workflows/governance.yml
@@ -19,6 +19,7 @@ on:
   workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
diff --git a/k9-svc/bindings/rust/.github/workflows/governance.yml b/k9-svc/bindings/rust/.github/workflows/governance.yml
@@ -19,6 +19,7 @@ on:
   workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
diff --git a/k9-svc/editors/vscode/.github/workflows/governance.yml b/k9-svc/editors/vscode/.github/workflows/governance.yml
@@ -19,6 +19,7 @@ on:
   workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
diff --git a/k9-svc/pandoc/.github/workflows/governance.yml b/k9-svc/pandoc/.github/workflows/governance.yml
@@ -19,6 +19,7 @@ on:
   workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
diff --git a/lol/.github/workflows/governance.yml b/lol/.github/workflows/governance.yml
@@ -19,6 +19,7 @@ on:
   workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
diff --git a/meta-a2ml/.github/workflows/governance.yml b/meta-a2ml/.github/workflows/governance.yml
@@ -19,6 +19,7 @@ on:
   workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
diff --git a/rhodium-standard-repositories/.github/workflows/governance.yml b/rhodium-standard-repositories/.github/workflows/governance.yml
@@ -19,6 +19,7 @@ on:
   workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
diff --git a/rhodium-standard-repositories/satellites/ECOSYSTEM.scm/.github/workflows/governance.yml b/rhodium-standard-repositories/satellites/ECOSYSTEM.scm/.github/workflows/governance.yml
@@ -19,6 +19,7 @@ on:
   workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
diff --git a/rhodium-standard-repositories/satellites/META.scm/.github/workflows/governance.yml b/rhodium-standard-repositories/satellites/META.scm/.github/workflows/governance.yml
@@ -19,6 +19,7 @@ on:
   workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
diff --git a/rhodium-standard-repositories/satellites/cccp/.github/workflows/governance.yml b/rhodium-standard-repositories/satellites/cccp/.github/workflows/governance.yml
@@ -19,6 +19,7 @@ on:
   workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
diff --git a/rhodium-standard-repositories/satellites/cccp/satellites/nextgen-languages/.github/workflows/governance.yml b/rhodium-standard-repositories/satellites/cccp/satellites/nextgen-languages/.github/workflows/governance.yml
@@ -19,6 +19,7 @@ on:
   workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
diff --git a/rhodium-standard-repositories/satellites/cccp/satellites/nextgen-languages/7-tentacles/.github/workflows/governance.yml b/rhodium-standard-repositories/satellites/cccp/satellites/nextgen-languages/7-tentacles/.github/workflows/governance.yml
@@ -19,6 +19,7 @@ on:
   workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
diff --git a/rhodium-standard-repositories/satellites/cccp/satellites/php-aegis/.github/workflows/governance.yml b/rhodium-standard-repositories/satellites/cccp/satellites/php-aegis/.github/workflows/governance.yml
@@ -19,6 +19,7 @@ on:
   workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
diff --git a/rhodium-standard-repositories/satellites/cccp/satellites/sanctify-php/.github/workflows/governance.yml b/rhodium-standard-repositories/satellites/cccp/satellites/sanctify-php/.github/workflows/governance.yml
@@ -19,6 +19,7 @@ on:
   workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
diff --git a/rhodium-standard-repositories/satellites/consent-aware-http/.github/workflows/governance.yml b/rhodium-standard-repositories/satellites/consent-aware-http/.github/workflows/governance.yml
@@ -19,6 +19,7 @@ on:
   workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
diff --git a/rhodium-standard-repositories/satellites/mustfile/.github/workflows/governance.yml b/rhodium-standard-repositories/satellites/mustfile/.github/workflows/governance.yml
@@ -19,6 +19,7 @@ on:
   workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
diff --git a/rhodium-standard-repositories/satellites/palimpsest-license/.github/workflows/governance.yml b/rhodium-standard-repositories/satellites/palimpsest-license/.github/workflows/governance.yml
@@ -19,6 +19,7 @@ on:
   workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
diff --git a/rhodium-standard-repositories/satellites/robot-repo-automaton/.github/workflows/governance.yml b/rhodium-standard-repositories/satellites/robot-repo-automaton/.github/workflows/governance.yml
@@ -19,6 +19,7 @@ on:
   workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
diff --git a/rhodium-standard-repositories/satellites/rsr-certifier/.github/workflows/governance.yml b/rhodium-standard-repositories/satellites/rsr-certifier/.github/workflows/governance.yml
@@ -19,6 +19,7 @@ on:
   workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
diff --git a/rhodium-standard-repositories/satellites/rsr-deployer/.github/workflows/governance.yml b/rhodium-standard-repositories/satellites/rsr-deployer/.github/workflows/governance.yml
@@ -19,6 +19,7 @@ on:
   workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
diff --git a/rhodium-standard-repositories/satellites/state.scm/.github/workflows/governance.yml b/rhodium-standard-repositories/satellites/state.scm/.github/workflows/governance.yml
@@ -19,6 +19,7 @@ on:
   workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
diff --git a/rhodium-standard-repositories/satellites/well-known-ecosystem/.github/workflows/governance.yml b/rhodium-standard-repositories/satellites/well-known-ecosystem/.github/workflows/governance.yml
@@ -19,6 +19,7 @@ on:
   workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
