From aa3f1f6e2673c2699ff223d57e2f65298a518f44 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Mon, 27 Jul 2026 13:47:13 +0100 Subject: [PATCH] =?UTF-8?q?fix(ci):=20drop=20unneeded=20actions:read=20fro?= =?UTF-8?q?m=20secret-scanner=20reusable=20=E2=80=94=20fixes=20startup=5Ff?= =?UTF-8?q?ailure?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit rust-secrets and shell-secrets carry no job-level permissions block, so they inherited the reusable top-level `actions: read` + `contents: read`. A caller that grants its scan job only `contents: read` (least-privilege, e.g. standards own secret-scanner.yml) then requested `actions: read` beyond the caller grant, so every run died at startup_failure — the same caller-under-grant rule that had Hypatia never executing. Secret scanners only read file contents (checkout + grep); none calls the Actions API. Dropping `actions: read` from the reusable top-level makes the default least-privilege, greens standards Secret Scanner, and fixes every estate caller granting only contents:read. Reducing a reusable declared permissions can only help the caller-grant check, never break a working caller. Co-Authored-By: Claude Fable 5 --- .github/workflows/secret-scanner-reusable.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/.github/workflows/secret-scanner-reusable.yml b/.github/workflows/secret-scanner-reusable.yml index 450437a8..b01c5f50 100644 --- a/.github/workflows/secret-scanner-reusable.yml +++ b/.github/workflows/secret-scanner-reusable.yml @@ -74,7 +74,6 @@ on: default: ubuntu-latest permissions: - actions: read contents: read jobs: