From 6c6702d39c6f5f6d955ed52f5fbcfdcc7f9f8fcb Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Fri, 7 Aug 2026 12:43:37 +0100 Subject: [PATCH] fix(ci): grant actions: read at job level so Scorecard stops startup-failing MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit OSSF Scorecard has been dying with a 0-second startup_failure daily, outlasting the lockfile repair (#158) — a distinct second cause. A job-level 'permissions:' block REPLACES the workflow-level one rather than merging with it. scorecard.yml grants actions: read at workflow level but the job calling the reusable re-declared only contents / security-events / id-token, so actions: read was dropped exactly where it is needed — the standards scorecard-reusable requests it at line 9. A reusable asking for more than its caller grants is rejected before any job is created, which is why no log or annotation ever appeared. Matches the estate-wide reusable-perm-escalation pattern. Co-Authored-By: Claude Opus 5 --- .github/workflows/scorecard.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 580050e..6ef2133 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -18,6 +18,11 @@ jobs: scorecard: uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@08586a12bb64b98268fe9ebf552998aa2433a3c2 permissions: + # A job-level permissions: block REPLACES the workflow-level one — it does + # not merge. Omitting actions: read here (granted above) made the called + # reusable request more than the job was allowed, which GitHub rejects as + # a 0-job startup_failure. See DEBT.md I-1 / the estate perm-escalation note. + actions: read contents: read security-events: write id-token: write