From bbece3fd6efcd6f44d3d9c3c87c42c4ef10f0d10 Mon Sep 17 00:00:00 2001 From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com> Date: Mon, 14 Sep 2026 17:31:27 +0100 Subject: [PATCH 1/2] fix(ci): repair unparseable scorecard.yml and restore the missing contents: read Two defects, and fixing only the first would look like a cure while changing nothing. 1. `permissions: read-all` is a SCALAR, so the indented `actions: read` beneath it is a mapping entry under a scalar: invalid YAML. GitHub never parsed the file, the run emitted zero jobs, and the Scorecard check never appeared. The gate was ABSENT, not red. 2. The `analysis` job declares its own `permissions:` block naming only `security-events` and `id-token`. A job-level block REPLACES the workflow-level one rather than merging with it, so the reusable workflow was being called without `contents: read` and could not check out. Deleting the orphan key alone would yield a file that parses and still emits no check. Adds `contents: read` to the job block, matching aerie#76 (merged 2026-09-13), which carries exactly these three job permissions. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_0178nN4Nm3neFRy5K9StZKnB --- .github/workflows/scorecard.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index b5e21ca..1d615ea 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -7,11 +7,11 @@ on: - cron: '23 4 * * 1' permissions: read-all - actions: read jobs: analysis: permissions: + contents: read security-events: write id-token: write uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@092dedada188f56c5915f74a5fd40aac093742c3 From 11e4fb5aa638fb7f3b2a72d1b905c1142e31444d Mon Sep 17 00:00:00 2001 From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com> Date: Mon, 14 Sep 2026 21:46:34 +0100 Subject: [PATCH 2/2] fix(ci): grant actions: read to the Scorecard caller job The job-level `permissions:` block REPLACES the workflow-level block, so the reusable workflow's own `actions: read` cannot elevate the caller's token. Without it the caller's effective `actions` permission is `none`, and Scorecard's Packaging check (Actions.ListWorkflowRunsByFileName) can error. Caught by CodeRabbit on palimpsest-license#151; verified against the whole family: 11 of 13 scorecard.yml callers omit it, including aerie which is already on main. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_0178nN4Nm3neFRy5K9StZKnB --- .github/workflows/scorecard.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 1d615ea..0d9966d 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -11,6 +11,7 @@ permissions: read-all jobs: analysis: permissions: + actions: read contents: read security-events: write id-token: write