fix(ci): restore the Scorecard SARIF upload deleted in June (security detection is currently OFF) #1401
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # SPDX-License-Identifier: MPL-2.0 | |
| # This workflow is managed by gh actions-lock. | |
| name: Secret Scanner | |
| on: | |
| pull_request: | |
| push: | |
| branches: [main] | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| jobs: | |
| scan: | |
| # `contents: read` is the complete grant the reusable needs. Note that this | |
| # job-level block REPLACES the workflow-level one for this job rather than | |
| # merging with it — so this line, not the block above, is what the called | |
| # workflow is measured against. | |
| permissions: | |
| contents: read | |
| # Local relative path, not an external SHA pin — this is the repo that | |
| # *owns* the reusable, so it must scan itself with the current version | |
| # (same pattern as governance.yml). | |
| # | |
| # HISTORY — this workflow has now failed startup twice, for two different | |
| # reasons, and the second failure is why the confident claim that used to | |
| # sit here ("a local path cannot re-stale, so this class of breakage cannot | |
| # recur") has been removed: | |
| # 1. Pin @891b1ed6 (2026-07-06) predated #500 and requested | |
| # `pull-requests: write` + `actions: read`. Fixed by moving to `./`. | |
| # 2. The reusable's *workflow-level* block still carried an unused | |
| # `actions: read`, which the rust-secrets and shell-secrets jobs | |
| # inherited. This caller correctly grants `contents: read` alone, so | |
| # every run was again rejected at startup. Fixed by removing the | |
| # unused grant and declaring `contents: read` on all three jobs. | |
| # Both were the same underlying fault — the callee requesting more than the | |
| # caller grants — so the local path fixed the symptom, not the class. | |
| # | |
| # A rejected run produces NO check run: `gh pr checks` shows nothing and the | |
| # annotations endpoint 404s, so this outage is invisible unless you look at | |
| # `gh run list --json conclusion`. Between these two faults, this repo's own | |
| # secret scanning did not execute — while a live credential sat in the tree. | |
| uses: ./.github/workflows/secret-scanner-reusable.yml | |
| secrets: inherit |