fix(ci): grant actions: read at job level so OSSF Scorecard stops startup-failing - #160
Merged
Merged
Conversation
…failing OSSF Scorecard has been dying with a 0-second startup_failure daily, outlasting the lockfile repair (#158) — a distinct second cause. A job-level 'permissions:' block REPLACES the workflow-level one rather than merging with it. scorecard.yml grants actions: read at workflow level but the job calling the reusable re-declared only contents / security-events / id-token, so actions: read was dropped exactly where it is needed — the standards scorecard-reusable requests it at line 9. A reusable asking for more than its caller grants is rejected before any job is created, which is why no log or annotation ever appeared. Matches the estate-wide reusable-perm-escalation pattern. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This comment has been minimized.
This comment has been minimized.
![gitar-bot[bot]](https://avatars.githubusercontent.com/in/827041?s=60&v=4){kind=small}
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
OSSF Scorecard has been dying daily with a 0-second
startup_failure, and it outlasted the lockfile repair in #158 — so it is a second, distinct cause.Cause
A job-level
permissions:block replaces the workflow-level one; it does not merge with it.scorecard.ymlgrantsactions: readat workflow level, but the job that calls the reusable re-declared onlycontents/security-events/id-token— droppingactions: readexactly where it is needed. The standardsscorecard-reusable.ymlrequestsactions: readat line 9, and a reusable asking for more than its caller grants is rejected before any job is created. That is why there was never a log, an annotation, or a check run to look at.This matches the estate-wide reusable-permission-escalation pattern.
Verification
Canary dispatch on this branch (run 31175237558): 1 job ran where previously there were 0. The startup rejection is gone.
That job then fails with
Only the default branch main is supported— which is the Scorecard action refusing to run on a non-default branch, i.e. an artefact of canarying on a branch, not a defect. It will run properly once this is onmain.🤖 Generated with Claude Code