From 18fd71e92ca5dcd861f4a2a5188fd52d2a341968 Mon Sep 17 00:00:00 2001 From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com> Date: Mon, 14 Sep 2026 17:30:39 +0100 Subject: [PATCH 1/2] fix(ci): remove orphan mapping key that made scorecard.yml unparseable MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `permissions: read-all` is a SCALAR. The indented `actions: read` beneath it is a mapping entry under a scalar, which is invalid YAML, so GitHub never parsed this workflow: the run emits zero jobs and the Scorecard check never appears at all. The gate was therefore ABSENT, not red — which is why this survived unnoticed. `read-all` already grants `actions: read`, so deleting the orphan line restores the file with no loss of permission. Same repair as aerie#76, merged 2026-09-13. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_0178nN4Nm3neFRy5K9StZKnB --- .github/workflows/scorecard.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index ae79ce0..37aef80 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -7,7 +7,6 @@ on: - cron: '23 4 * * 1' permissions: read-all - actions: read jobs: analysis: From b4fa3261bd01a011e3866af587f168928687a9b7 Mon Sep 17 00:00:00 2001 From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com> Date: Mon, 14 Sep 2026 21:45:50 +0100 Subject: [PATCH 2/2] fix(ci): grant actions: read to the Scorecard caller job The job-level `permissions:` block REPLACES the workflow-level block, so the reusable workflow's own `actions: read` cannot elevate the caller's token. Without it the caller's effective `actions` permission is `none`, and Scorecard's Packaging check (Actions.ListWorkflowRunsByFileName) can error. Caught by CodeRabbit on palimpsest-license#151; verified against the whole family: 11 of 13 scorecard.yml callers omit it, including aerie which is already on main. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_0178nN4Nm3neFRy5K9StZKnB --- .github/workflows/scorecard.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 37aef80..f3ee831 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -12,6 +12,7 @@ jobs: analysis: uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@092dedada188f56c5915f74a5fd40aac093742c3 permissions: + actions: read contents: read security-events: write id-token: write