From 8fcc469d45c7c86aaf07322d0d2e47714a6e4714 Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Thu, 6 Aug 2026 08:40:40 +0100
Subject: [PATCH] fix(ci): grant reusable callers the permissions their
 reusable declares
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The governance and Hypatia workflows here are `startup_failure` on every run —
not failing, never starting. GitHub refuses to begin a reusable-workflow call
whose caller grants LESS than the reusable itself declares, and the refusal
happens before any job exists: no log, no check run, and no row in
`gh pr checks`.

That has a second consequence that is easy to misdiagnose. Because the
workflow never emits its status context, a perfectly correct branch rule
requiring `governance / Validate Hypatia Baseline` looks like a PHANTOM — a
rule naming something that does not exist. It is not: the rule is right and
the workflow is broken. Rewriting the rule would have converted "this check is
broken" into "this check is not required", which is how enforcement quietly
evaporates.

The reference is haec, which runs the identical reusables at the identical pin
successfully. It grants:

    permissions:
      actions: read
      contents: read

while the repos stuck at startup_failure grant only `contents: read`.

This adds the missing `actions: read` and nothing else. It deliberately does
not widen permissions further — over-granting is how a scanner quietly gains
write access it was never meant to have.

Found by the estate CI/CD census (hyperpolymath/standards#583), which pairs
what each repository REQUIRES against what it actually EMITS.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>
---
 .github/workflows/mirror.yml         | 1 +
 .github/workflows/scorecard.yml      | 1 +
 .github/workflows/secret-scanner.yml | 1 +
 3 files changed, 3 insertions(+)

diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml
index 2b7049f..bd1d7e1 100644
--- a/.github/workflows/mirror.yml
+++ b/.github/workflows/mirror.yml
@@ -6,6 +6,7 @@ on:
     branches: [main]
   workflow_dispatch:
 permissions:
+  actions: read
   contents: read
 jobs:
   mirror:
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 2b35e68..b472a1b 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -10,6 +10,7 @@ on:
   workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml
index 76f15a0..470bf74 100644
--- a/.github/workflows/secret-scanner.yml
+++ b/.github/workflows/secret-scanner.yml
@@ -9,6 +9,7 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 permissions:
+  actions: read
   contents: read
 jobs:
   scan: