From 491d7ceac4beb20ed4ae36f568e5d6759805d65c Mon Sep 17 00:00:00 2001 From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com> Date: Mon, 14 Sep 2026 17:32:05 +0100 Subject: [PATCH 1/2] fix(ci): reconstruct scorecard.yml, whose uses: line was spliced into a permission The permissions sweep did more damage here than anywhere else in this class. Three things were wrong at once: 1. The `analysis` job's `permissions:` block was de-indented to column 2, so it read as a continuation of the workflow-level mapping rather than as part of the job. 2. The `uses:` key was appended to the END of the `id-token: write` line, making the reusable-workflow call part of a scalar value instead of a key. 3. The result did not parse, so GitHub never read the workflow: the run emitted zero jobs and the Scorecard check never appeared. The gate was ABSENT, not red. Because the `uses:` line was destroyed rather than merely displaced, this one could not be repaired by deleting a line like its nine siblings; the job had to be written out again. The reconstruction keeps this repo's explicit three-key workflow-level block (it never used `read-all`), restores the same pin that was already there (092dedada188f56c5915f74a5fd40aac093742c3), and gives the job the same three permissions as aerie#76, merged 2026-09-13. Verified with `yq` and `actionlint`, both clean. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_0178nN4Nm3neFRy5K9StZKnB --- .github/workflows/scorecard.yml | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 30083b89..c4878fbd 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -10,10 +10,12 @@ permissions: contents: read security-events: write id-token: write + jobs: analysis: + uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@092dedada188f56c5915f74a5fd40aac093742c3 permissions: - contents: read - security-events: write - id-token: write uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@092dedada188f56c5915f74a5fd40aac093742c3 + contents: read + security-events: write + id-token: write secrets: inherit From b7d71f2157204d41fe34e83aca0c677ba4794f53 Mon Sep 17 00:00:00 2001 From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com> Date: Mon, 14 Sep 2026 21:45:41 +0100 Subject: [PATCH 2/2] fix(ci): grant actions: read to the Scorecard caller job The job-level `permissions:` block REPLACES the workflow-level block, so the reusable workflow's own `actions: read` cannot elevate the caller's token. Without it the caller's effective `actions` permission is `none`, and Scorecard's Packaging check (Actions.ListWorkflowRunsByFileName) can error. Caught by CodeRabbit on palimpsest-license#151; verified against the whole family: 11 of 13 scorecard.yml callers omit it, including aerie which is already on main. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_0178nN4Nm3neFRy5K9StZKnB --- .github/workflows/scorecard.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index c4878fbd..d554faad 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -15,6 +15,7 @@ jobs: analysis: uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@092dedada188f56c5915f74a5fd40aac093742c3 permissions: + actions: read contents: read security-events: write id-token: write