fix(ci): grant callers the "actions: read" their reusables request

[hyperpolymath]

Two workflows have been dead at startup_failure — zero jobs, no log, no annotation — readme-derive.yml since 2026-08-07 and changelog.yml since 2026-08-24.

Why this took work to find

startup_failure emits nothing a tool can read. The full run record via REST reports total_count=0 jobs and carries no message field; GraphQL has none either. The reason exists only as rendered HTML in the run page banner. I fetched it:

Error calling workflow 'hyperpolymath/standards/.github/workflows/changelog-reusable.yml@a22a7abf'. The workflow is requesting 'actions: read', but is only allowed 'actions: none'.

The mechanism

A caller that declares a permissions: block at all receives none for every key it does not list. Both callers declared one and omitted actions::

caller	granted	reusable requests	result
changelog.yml	contents: write, pull-requests: write	actions: read	❌ rejected pre-start
readme-derive.yml	contents: write	actions: read	❌ rejected pre-start

This is why it reads as "misconfigured permissions" rather than "missing permission" — nothing was ever removed; the omission itself is the denial.

Corroboration — two independent methods agree

Besides the banner, a static sweep of all 11 caller→reusable pairs in this repo independently flags these two, and only these two. After the fix it reports 0.

❌ changelog.yml        -> changelog-reusable.yml        actions
❌ readme-derive.yml    -> readme-derive-reusable.yml    actions
✅ codeql / deno-ci / elixir-ci / governance / hypatia-scan / rust-ci / scorecard / secret-scanner

What this is NOT — ruled out, so nobody repeats it

candidate	result
lockfile mode 1–4 (absent / no entry / under-declares / drift)	❌ check-lockfile-drift.sh → clean — 41 workflow(s)
YAML unparseable	❌ both files yaml.safe_load cleanly
PR #622 "enforce live Actions policy"	❌ disproved — governance.yml ran healthily 3× after #622 merged
Actions allowlist	❌ not for these two — but see below

⚠️ A second, separate cause is still open — and it needs you, not code

Three other workflows are dead for a completely different reason, confirmed from their banners:

"The action editorconfig-checker/action-editorconfig-checker@840e866d… is not allowed in hyperpolymath/standards because all actions must be from a repository owned by hyperpolymath, created by GitHub, or verified in the GitHub Marketplace."

workflow	blocked action
governance.yml	editorconfig-checker/action-editorconfig-checker
casket-pages.yml	haskell-actions/setup
affinescript-verify.yml	ocaml/setup-ocaml

The repo has allowed_actions: "selected" with patterns_allowed: []. That is a repository settings change, not a code change, so it is deliberately not in this PR.

governance.yml being dead is why governance / Validate Hypatia Baseline and governance / Code quality + docs are 2 of the 8 required contexts on ruleset Optimus-Branch that never report — which is why PRs here sit at BLOCKED with every reported check green.

Related: #399.

[coderabbitai]

Warning

Review limit reached

Next included review available in 43 minutes.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: d6263c84-8dc6-41c5-b080-e21bbd4c2395

📥 Commits

Reviewing files that changed from the base of the PR and between 6cb237c and 3f928e1.

📒 Files selected for processing (4)

• .github/workflows/changelog.yml
• .github/workflows/readme-derive.yml
• .machine_readable/REGISTRY.a2ml
• .machine_readable/scorecards/0-ai-gatekeeper-protocol.scorecard.a2ml

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}

[gitar-bot]

Important

You are using the Gitar free plan. Upgrade to unlock code review, CI analysis, auto-apply, custom automations, and more.

_Gitar

[codacy-production]

Pull Request Overview

The PR successfully addresses the startup_failure in the Changelog and README Derive workflows by granting the necessary actions: read permissions.

However, the review identified significant undocumented changes, including multiple source_hash updates and a scorecard modification. Most critically, a logical contradiction exists in the scorecard file: a requirement is marked with status = "fail" yet assigned check = "true". This inconsistency could impact automated validation and should be corrected before merging.

About this PR

• This PR contains significant scope misalignment. In addition to the CI permission fixes, there are 16 hunks of source hash updates in the registry and a manual scorecard update that are not documented in the PR title or description.

Test suggestions

• Verify actions: read is present in the permissions block of the Changelog workflow
• Verify actions: read is present in the permissions block of the README Derive workflow

_{TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback}