From 332f261e202528a1e5006c363cc1bac302365bd8 Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Thu, 6 Aug 2026 08:40:26 +0100
Subject: [PATCH] fix(ci): grant reusable callers the permissions their
 reusable declares
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The governance and Hypatia workflows here are `startup_failure` on every run —
not failing, never starting. GitHub refuses to begin a reusable-workflow call
whose caller grants LESS than the reusable itself declares, and the refusal
happens before any job exists: no log, no check run, and no row in
`gh pr checks`.

That has a second consequence that is easy to misdiagnose. Because the
workflow never emits its status context, a perfectly correct branch rule
requiring `governance / Validate Hypatia Baseline` looks like a PHANTOM — a
rule naming something that does not exist. It is not: the rule is right and
the workflow is broken. Rewriting the rule would have converted "this check is
broken" into "this check is not required", which is how enforcement quietly
evaporates.

The reference is haec, which runs the identical reusables at the identical pin
successfully. It grants:

    permissions:
      actions: read
      contents: read

while the repos stuck at startup_failure grant only `contents: read`.

This adds the missing `actions: read` and nothing else. It deliberately does
not widen permissions further — over-granting is how a scanner quietly gains
write access it was never meant to have.

Found by the estate CI/CD census (hyperpolymath/standards#583), which pairs
what each repository REQUIRES against what it actually EMITS.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>
---
 .github/workflows/governance.yml     | 1 +
 .github/workflows/hypatia-scan.yml   | 1 +
 .github/workflows/mirror.yml         | 1 +
 .github/workflows/rust-ci.yml        | 1 +
 .github/workflows/scorecard.yml      | 1 +
 .github/workflows/secret-scanner.yml | 1 +
 6 files changed, 6 insertions(+)

diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml
index 8161ec2..d0a0e54 100644
--- a/.github/workflows/governance.yml
+++ b/.github/workflows/governance.yml
@@ -9,6 +9,7 @@ on:
   workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml
index 329d83f..842ab67 100644
--- a/.github/workflows/hypatia-scan.yml
+++ b/.github/workflows/hypatia-scan.yml
@@ -11,6 +11,7 @@ on:
   workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
   security-events: read
 
diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml
index f4ddfca..dd5f025 100644
--- a/.github/workflows/mirror.yml
+++ b/.github/workflows/mirror.yml
@@ -5,6 +5,7 @@ on:
     branches: [main]
   workflow_dispatch:
 permissions:
+  actions: read
   contents: read
 jobs:
   mirror:
diff --git a/.github/workflows/rust-ci.yml b/.github/workflows/rust-ci.yml
index a4c3019..7859867 100644
--- a/.github/workflows/rust-ci.yml
+++ b/.github/workflows/rust-ci.yml
@@ -8,6 +8,7 @@ on:
     branches: [main, master]
   pull_request:
 permissions:
+  actions: read
   contents: read
 jobs:
   rust-ci:
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 521fc83..9aeb664 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -9,6 +9,7 @@ on:
   workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml
index d027a59..87f893a 100644
--- a/.github/workflows/secret-scanner.yml
+++ b/.github/workflows/secret-scanner.yml
@@ -8,6 +8,7 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 permissions:
+  actions: read
   contents: read
 jobs:
   scan: