From 7e41637c70d882156ea1cb6bfc74f53c16648ed4 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Mon, 10 Aug 2026 13:15:08 +0100 Subject: [PATCH] fix(ci): drop the unused top-level actions: read from scorecard-reusable Co-Authored-By: Claude Opus 5 Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com> --- .github/workflows/scorecard-reusable.yml | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/.github/workflows/scorecard-reusable.yml b/.github/workflows/scorecard-reusable.yml index d71898d3..90aa0918 100644 --- a/.github/workflows/scorecard-reusable.yml +++ b/.github/workflows/scorecard-reusable.yml @@ -5,8 +5,13 @@ name: OSSF Scorecard Reusable Workflow on: workflow_call: +# NOTE: no top-level `actions: read` here. It was added by the estate-wide +# security-compliance sweep (0ced540e) but no job in this file uses it, and a +# reusable's top-level permissions must be granted by EVERY caller — callers +# granting the estate-default `contents: read` (+ their own job needs) hit a +# 0-second startup_failure before any job runs. Same lesson as the note in +# rust-ci-reusable.yml. The scorecard job declares its own block below. permissions: - actions: read contents: read jobs: