From 36d0b920e6c1525ef032c5e5b2b527b8f40cd20c Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Thu, 6 Aug 2026 04:22:19 +0100
Subject: [PATCH] fix(ci): repair workflows that are not valid YAML and have
 never run
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

GitHub Actions rejects an unparseable workflow before creating any job: the
run is `failure` with no jobs, no log and no check run. These files have never
executed once.

All of it traces to sweeps that edited by LINE POSITION rather than by parsing.
The shapes repaired here:

  * A permissions block substituted INTO A QUOTED SHELL STRING, splitting it:

        echo "Add 'permissions:
      contents: read' at workflow level"

    The second line sits at 2-space indent, less than the surrounding block
    scalar, so it terminates the block and YAML tries to parse it. Rejoined.

  * A top-level `permissions:` block dropped INSIDE a job, at column 0 between
    `timeout-minutes` and `steps`. Removed; the job is covered by the
    top-level declaration.

  * TWO top-level `permissions:` blocks. Merged, keeping the widest value for
    each key (write > read > none) — the only choice that cannot remove a
    capability a job already relies on.

  * An embedded interpreter script written at column 0 inside `run: |`,
    ending the block scalar. Re-indented into it. Safe for the program too:
    YAML strips the block-scalar indent when building the string, so the shell
    and Python still receive it at column 0 with relative indentation intact.

  * A `run:` scalar containing ": " inside a quoted string, which YAML reads
    as a mapping. Converted to a block scalar.

VERIFIED: every workflow in this repository parses after the change, and each
repairer refuses to write a file that does not parse and still contain jobs.

Part of an estate-wide repair — 67 repositories, 100 workflow files. The
most frequently broken file was workflow-linter.yml, in 22 repositories: the
workflow whose job is to lint workflows was itself unparseable, so it never
ran and never caught this.

Detection is being added upstream so it cannot recur invisibly:
hyperpolymath/standards#582. Ordinary validation cannot see this class of
fault — yaml.safe_load silently keeps the last duplicate and reports success.

EXPECT THIS REPOSITORY TO GET LOUDER.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>
---
 .github/workflows/mirror.yml | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml
index 2bd44bf5..4d61c13b 100644
--- a/.github/workflows/mirror.yml
+++ b/.github/workflows/mirror.yml
@@ -18,9 +18,6 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
-permissions:
-  actions: read
-  contents: read
 
 jobs:
   mirror: