From 3c2c830f11750faaa6b979b644f3d0fbb231305d Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Mon, 3 Aug 2026 19:50:15 +0100 Subject: [PATCH] fix(ci): re-pin standards reusables past the lockfile boundary + align caller perms MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The five standards-reusable callers were the last startup_failures: enforcement demands a lockfile in the CALLED repo at the pinned ref, and d135b05 predates standards' actions.lock (#570). Re-pin all five to 5a597720 (standards main, lockfile present). The 186-commit jump also raised the reusables' permission demands — governance/hypatia/mirror/scorecard now declare `actions: read`, and a reusable requesting more than its caller grants is itself a startup_failure. Callers now grant the exact union each reusable requests (job-level blocks replace, not merge, so scorecard's job block carries the full set). Co-Authored-By: Claude Fable 5 --- .github/workflows/governance.yml | 3 ++- .github/workflows/hypatia-scan.yml | 3 ++- .github/workflows/mirror.yml | 3 ++- .github/workflows/scorecard.yml | 3 ++- .github/workflows/secret-scanner.yml | 2 +- 5 files changed, 9 insertions(+), 5 deletions(-) diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index 1650ae5..0239fdd 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -10,6 +10,7 @@ on: workflow_dispatch: permissions: + actions: read contents: read concurrency: @@ -18,4 +19,4 @@ concurrency: jobs: governance: - uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236 + uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@5a597720580d12fa04d24e1b9e100e2eb8d6e653 diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index 829ae18..30d86dd 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -12,9 +12,10 @@ on: workflow_dispatch: permissions: + actions: read contents: read security-events: write jobs: scan: - uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236 + uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@5a597720580d12fa04d24e1b9e100e2eb8d6e653 diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index 1f60f1c..6fabfb1 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -6,8 +6,9 @@ on: branches: [main] workflow_dispatch: permissions: + actions: read contents: read jobs: mirror: - uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236 + uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@5a597720580d12fa04d24e1b9e100e2eb8d6e653 secrets: inherit diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 0c4aed8..d53591c 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -20,7 +20,8 @@ jobs: # caller's top-level contents: read; a reusable requesting more # permissions than its caller grants is a startup_failure. permissions: + actions: read contents: read security-events: write id-token: write - uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236 + uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@5a597720580d12fa04d24e1b9e100e2eb8d6e653 diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index 2be1ae9..b178b77 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -12,5 +12,5 @@ permissions: contents: read jobs: scan: - uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236 + uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@5a597720580d12fa04d24e1b9e100e2eb8d6e653 secrets: inherit