Repository navigation
ci: drop secrets: inherit from the scanner; grant actions: read on the scorecard job - #14
Conversation
…e scorecard job The secret-scanner reusable (standards@75bd5994) declares no secrets and reads none; its gitleaks is a pinned local binary. The 'secrets: inherit is REQUIRED' header predates that and forwarded every repository secret for nothing. The scorecard caller's job-level permissions block replaces the workflow-level one, so it dropped actions: read, which the callee's job requests; GitHub refuses a called job that asks for more than its caller grants. Repeat actions: read in the job block. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MF5GeeBBDF6sUzr6pZTjWV
|
Note Currently processing new changes in this PR. This may take a few minutes, please wait... ⚙️ Run configuration
📒 Files selected for processing: 2
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
Summary
Two small workflow fixes, both checked against the callee at the pinned standards commit (
75bd5994).secret-scanner.ymlforwards every repository secret withsecrets: inherit, but the reusable scanner declares no secrets and reads none (its gitleaks is a pinned local binary). The "REQUIRED" header described an older gitleaks action.scorecard.yml's job-levelpermissions:block replaces the workflow-level one, so it droppedactions: read, which the callee's job requests. GitHub refuses a called job that asks for more than its caller grants, so the scheduled Scorecard run would fail at startup with no jobs (same cause as choreographic-types #31).Changes
.github/workflows/secret-scanner.yml: removesecrets: inherit; replace the stale comment with the reason it is absent..github/workflows/scorecard.yml: addactions: readto the job-levelpermissions:, with a comment saying why it repeats the workflow-level grant.RSR Quality Checklist
Required
.envfiles includedAs Applicable
scripts/check-lock-sync.shpasses;scripts/check-action-pinning.jspasses (nouses:changed)Testing
Both files parse and both lock scripts pass. The scorecard change can only be proven by a scheduled or manual Scorecard run; a branch run cannot exercise it.
Generated by Claude Code