From a03906d12cf005807bd59ddcf209f5de5326421a Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Mon, 21 Sep 2026 09:07:40 +0100
Subject: [PATCH] fix(ci): grant the calling job the union of the callee's
 permissions (scorecard)

---
 .github/workflows/scorecard.yml | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 85b16ab..b5f142a 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -11,4 +11,8 @@ permissions:
 
 jobs:
   scorecard:
-    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@d7c22711e830e1f383846472f6e9b99debdb201e
\ No newline at end of file
+    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@d7c22711e830e1f383846472f6e9b99debdb201e
+    permissions:
+      contents: read
+      id-token: write
+      security-events: write