From e3dd9af25d711df8e4840bf1d7481d7f0f912fd8 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 19 Oct 2026 22:33:43 +0000 Subject: [PATCH] ci: drop secrets: inherit from the scanner; grant actions: read on the scorecard job The secret-scanner reusable (standards@75bd5994) declares no secrets and reads none; its gitleaks is a pinned local binary. The 'secrets: inherit is REQUIRED' header predates that and forwarded every repository secret for nothing. The scorecard caller's job-level permissions block replaces the workflow-level one, so it dropped actions: read, which the callee's job requests; GitHub refuses a called job that asks for more than its caller grants. Repeat actions: read in the job block. Co-Authored-By: Claude Sonnet 5.5 Claude-Session: https://claude.ai/code/session_01MF5GeeBBDF6sUzr6pZTjWV --- .github/workflows/scorecard.yml | 3 +++ .github/workflows/secret-scanner.yml | 7 ++++--- 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 8d34818..48d333b 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -20,7 +20,10 @@ jobs: # Reusable called-workflow permissions are CAPPED by the caller's grants; # without security-events: write here the scorecard SARIF upload fails with # startup_failure (hypatia WF018). id-token: write enables OIDC publish. + # actions: read must be repeated here: a job-level block replaces the + # workflow-level one, and the callee's job asks for actions: read. permissions: + actions: read contents: read security-events: write id-token: write diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index 0e7af9d..9b6c366 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -2,8 +2,10 @@ # Calls the estate's shared secret scanner (gitleaks + rust-secrets + # shell-secrets). # -# `secrets: inherit` is REQUIRED: without it the gitleaks action's inner -# secrets.GITHUB_TOKEN is empty and the scan silently degrades. +# No `secrets:` line: the reusable workflow (standards@75bd5994) declares no +# secrets and reads none. Its gitleaks is a pinned local binary, and the +# GITHUB_TOKEN its jobs run under is governed by `permissions:`, not by secret +# passing. `secrets: inherit` would forward every repository secret for nothing. name: "Secret Scanner" on: push: @@ -21,4 +23,3 @@ permissions: jobs: scan: uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66 - secrets: inherit