From 1fe1f543ed67154ffaef40e247245b3181003c4f Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Tue, 21 Jul 2026 05:34:07 +0100
Subject: [PATCH] fix(ci): grant the secret-scanner reusable its required job
 permissions
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The `scan` job calls secret-scanner-reusable.yml, whose `gitleaks` job
declares `pull-requests: write` (PR summary comment) and `actions: read`
(workflow-run metadata) at job level. A called reusable workflow may only
request permissions equal to or more restrictive than its caller. This
caller granted only the file-level `contents: read`, so GitHub refused the
run at parse time and every Secret Scanner run ended in `startup_failure` —
secret scanning has not actually executed in this repo since the pin landed.

Grants the superset at job level, matching the canonical template and the
176 estate repos whose scanner already runs. No SHA pin is changed.
---
 .github/workflows/secret-scanner.yml | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml
index 3d08704..bfd87c3 100644
--- a/.github/workflows/secret-scanner.yml
+++ b/.github/workflows/secret-scanner.yml
@@ -11,6 +11,13 @@ permissions:
   contents: read
 jobs:
   scan:
+    # The reusable's gitleaks job requests pull-requests: write (PR summary
+    # comment) and actions: read (workflow-run metadata) at job level; the
+    # caller must grant at least that or the run startup-fails.
+    permissions:
+      contents: read
+      pull-requests: write
+      actions: read
     uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@09e7023d24682621bea4e11965a1ef5e87d86c3b
     secrets: inherit
   trufflehog: