fix(ci): grant reusable callers the permissions their reusable declares - #39
Conversation
The governance and Hypatia workflows here are `startup_failure` on every run —
not failing, never starting. GitHub refuses to begin a reusable-workflow call
whose caller grants LESS than the reusable itself declares, and the refusal
happens before any job exists: no log, no check run, and no row in
`gh pr checks`.
That has a second consequence that is easy to misdiagnose. Because the
workflow never emits its status context, a perfectly correct branch rule
requiring `governance / Validate Hypatia Baseline` looks like a PHANTOM — a
rule naming something that does not exist. It is not: the rule is right and
the workflow is broken. Rewriting the rule would have converted "this check is
broken" into "this check is not required", which is how enforcement quietly
evaporates.
The reference is haec, which runs the identical reusables at the identical pin
successfully. It grants:
permissions:
actions: read
contents: read
while the repos stuck at startup_failure grant only `contents: read`.
This adds the missing `actions: read` and nothing else. It deliberately does
not widen permissions further — over-granting is how a scanner quietly gains
write access it was never meant to have.
Found by the estate CI/CD census (hyperpolymath/standards#583), which pairs
what each repository REQUIRES against what it actually EMITS.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>
|
|
Note Automatic reviews are paused because your trial's included automatic processing has been used for this period. Upgrade now, or comment "Gitar review" to run a review anytime. Code Review ✅ ApprovedGrants actions: read permissions to CI reusable callers to resolve startup failures caused by permission mismatches. No issues found.
OptionsDisplay: compact → Showing less information. Comment with these commands to change the behavior for this request:
Important Your trial ends in 4 days — upgrade now to keep code review, CI analysis, auto-apply, custom automations, and more. Was this helpful? React with 👍 / 👎 | Gitar |
![gitar-bot[bot]](https://avatars.githubusercontent.com/in/827041?s=60&v=4){kind=small}
1 participant
The governance and Hypatia workflows here are
startup_failureon every run — not failing, never starting.GitHub refuses to begin a reusable-workflow call whose caller grants less than the reusable itself declares. The refusal happens before any job exists: no log, no check run, no row in
gh pr checks.Why this was misdiagnosed as something else
Because the workflow never emits its status context, a perfectly correct branch rule requiring
governance / Validate Hypatia Baselinelooks like a phantom — a rule naming something that doesn't exist.It isn't. The rule is right and the workflow is broken. Rewriting the rule would have converted "this check is broken" into "this check is not required" — which is exactly how enforcement quietly evaporates, and it was the outcome I nearly produced before checking workflow health.
The fix
haecruns the identical reusables at the identical pin, successfully. It grants:The repos stuck at
startup_failuregrant onlycontents: read.This adds the missing
actions: readand nothing else. It deliberately does not widen permissions further — over-granting is how a scanner quietly acquires write access it was never meant to have.Found by the estate CI/CD census (hyperpolymath/standards#583), which pairs what each repository requires against what it actually emits.
🤖 Generated with Claude Code