From 50f44df48341408693ac3ce2095bd519fbcfb0d3 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Mon, 27 Jul 2026 19:53:14 +0100 Subject: [PATCH] =?UTF-8?q?fix(ci):=20clear=20the=20three=20remaining=20re?= =?UTF-8?q?d=20workflows=20=E2=80=94=20scorecard=20perms,=20TLA+=20checksu?= =?UTF-8?q?m,=20Pages=20timeout?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Three independent one-line fixes: - scorecard.yml: grant contents: read on the caller job. The reusable at the pinned SHA declares workflow-level contents: read; the caller's explicit job permissions (security-events + id-token only) replaced the default grant, so the reusable exceeded its caller and Actions refused the run at parse time (startup_failure, zero jobs). - tla-consensus.yml: re-pin the tla2tools.jar sha256. Upstream rebuilt the v1.8.0 release asset on 2026-07-18 (per the jar manifest Build-TimeStamp), so the old checksum no longer matches. New checksum measured from a fresh download of the same version-tagged URL. - casket-pages.yml: raise the build job timeout 15 -> 35 minutes. The cold GHC/cabal build of casket-ssg exceeds 15 minutes, and because the job dies mid-build the Cabal cache never saves — every subsequent run is cold again. Timed-out steps report as 'cancelled', which masked this as manual cancellation. Once one run completes and saves the cache, subsequent builds should be fast. Co-Authored-By: Claude Fable 5 --- .github/workflows/casket-pages.yml | 2 +- .github/workflows/scorecard.yml | 1 + .github/workflows/tla-consensus.yml | 2 +- 3 files changed, 3 insertions(+), 2 deletions(-) diff --git a/.github/workflows/casket-pages.yml b/.github/workflows/casket-pages.yml index d9a1d6d..2c7c506 100644 --- a/.github/workflows/casket-pages.yml +++ b/.github/workflows/casket-pages.yml @@ -14,7 +14,7 @@ concurrency: jobs: build: runs-on: ubuntu-latest - timeout-minutes: 15 + timeout-minutes: 35 steps: - name: Checkout uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index d1c2220..35eaf1e 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -11,6 +11,7 @@ permissions: read-all jobs: analysis: permissions: + contents: read security-events: write id-token: write uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9 diff --git a/.github/workflows/tla-consensus.yml b/.github/workflows/tla-consensus.yml index 4486881..2f3751f 100644 --- a/.github/workflows/tla-consensus.yml +++ b/.github/workflows/tla-consensus.yml @@ -36,7 +36,7 @@ jobs: run: | curl -fsSL -o tla2tools.jar \ https://github.com/tlaplus/tlaplus/releases/download/v1.8.0/tla2tools.jar - echo "237332bdcc79a35c7d26efa7b82c77c85c2744591c5598673a8a45085ff2a4fb tla2tools.jar" \ + echo "cc4803dce2a8ffaf0f5920a9dc39df4b5ee34ab4cb53fb58ac557277a7e516b3 tla2tools.jar" \ | sha256sum -c - - name: TLC positive — all safety invariants hold at Threshold = 2F+1