From 3f928e1e5960505db19ab05e973537f708c3b5cd Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Wed, 26 Aug 2026 20:15:38 +0100 Subject: [PATCH] fix(ci): grant callers the "actions: read" their reusables request MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit changelog.yml and readme-derive.yml have been dead at startup_failure — zero jobs, no log, no annotation — since 2026-08-07 and 2026-08-24. The reason is invisible to the REST and GraphQL APIs; it exists only in the run page banner, which states it exactly: Error calling workflow '.../changelog-reusable.yml@a22a7abf'. The workflow is requesting 'actions: read', but is only allowed 'actions: none'. A caller that declares a "permissions:" block at all receives "none" for every key it does NOT list. changelog.yml granted contents+pull-requests, readme-derive.yml granted contents — so both silently denied the "actions: read" their reusables declare, and GitHub rejected the run before any job could start. Corroborated two ways: the banner text above, and a static sweep of all 11 caller/reusable pairs in this repo, which independently identifies these two and only these two. After the fix that sweep reports 0. NOT the cause here, and checked: all four actions.lock failure modes (clean), YAML validity (both parse), and the Actions allowlist. The allowlist IS killing three OTHER workflows (governance, casket-pages, affinescript-verify) — that is a repo-settings fix, not a code one, and is reported separately. Co-Authored-By: Claude Opus 5 --- .github/workflows/changelog.yml | 5 +++ .github/workflows/readme-derive.yml | 5 +++ .machine_readable/REGISTRY.a2ml | 32 +++++++++---------- .../0-ai-gatekeeper-protocol.scorecard.a2ml | 1 + 4 files changed, 27 insertions(+), 16 deletions(-) diff --git a/.github/workflows/changelog.yml b/.github/workflows/changelog.yml index 3b3fb0b9..839fd4b5 100644 --- a/.github/workflows/changelog.yml +++ b/.github/workflows/changelog.yml @@ -9,6 +9,11 @@ on: - 'CHANGELOG.md' permissions: + # Required: the reusable this calls requests `actions: read`. A caller that + # declares `permissions:` at all gets `none` for every key it omits, so + # leaving this out makes GitHub reject the run at startup_failure with zero + # jobs and no log — "requesting 'actions: read', but is only allowed 'actions: none'". + actions: read contents: write pull-requests: write diff --git a/.github/workflows/readme-derive.yml b/.github/workflows/readme-derive.yml index b07c555e..ef8408de 100644 --- a/.github/workflows/readme-derive.yml +++ b/.github/workflows/readme-derive.yml @@ -19,6 +19,11 @@ concurrency: cancel-in-progress: true permissions: + # Required: the reusable this calls requests `actions: read`. A caller that + # declares `permissions:` at all gets `none` for every key it omits, so + # leaving this out makes GitHub reject the run at startup_failure with zero + # jobs and no log — "requesting 'actions: read', but is only allowed 'actions: none'". + actions: read contents: write jobs: diff --git a/.machine_readable/REGISTRY.a2ml b/.machine_readable/REGISTRY.a2ml index 11124a01..adbcbf54 100644 --- a/.machine_readable/REGISTRY.a2ml +++ b/.machine_readable/REGISTRY.a2ml @@ -45,7 +45,7 @@ name = "A2ML — Attested Markup Language" stream = "foundation" home = "a2ml/" canonical_doc = "a2ml/README.adoc" -source_hash = "sha256:a79bce448d650dabd8d831212880b4814da1d1f6583de0ad2d39875c5a1fbecf" +source_hash = "sha256:0a1d767bef0a5eb5c9483598d92d12d998e7544a71ee1683be6938bdf346cd66" route = "the typed/verified machine-readable document format" [[spec]] @@ -54,7 +54,7 @@ name = "K9 Self-Validating Components" stream = "foundation" home = "k9-svc/" canonical_doc = "k9-svc/README.adoc" -source_hash = "sha256:6bcd9a401b27600886129a8b644746fff23e4633b51936b965f51238afb9fa04" +source_hash = "sha256:47567d4bd1b00ffc3ab42cdea886519373a31814be8471893255472ec1989d81" route = "self-validating components with embedded contracts + deploy logic" [[spec]] @@ -72,7 +72,7 @@ name = "META.a2ml spec" stream = "foundation" home = "meta-a2ml/" canonical_doc = "meta-a2ml/README.adoc" -source_hash = "sha256:2818a77ee141782f336b43f2266783691064b775deb33ea768c1560268375835" +source_hash = "sha256:bd3936fa6ba46443167950d983749e4b130373183f3d647aa60aebde7789bede" route = "architecture decisions / governance metadata format" [[spec]] @@ -81,7 +81,7 @@ name = "STATE.a2ml spec" stream = "foundation" home = "state-a2ml/" canonical_doc = "state-a2ml/README.adoc" -source_hash = "sha256:b610769df9d0119793f830208be964c97894242c987c3a9791856d06f7b24f29" +source_hash = "sha256:8ec140f16e80e96a53c8365df6c06fea50bf2625f84e4ddaa306e5d10721af18" route = "project-state metadata format (drives this registry's topology)" [[spec]] @@ -90,7 +90,7 @@ name = "ECOSYSTEM.a2ml spec" stream = "foundation" home = "ecosystem-a2ml/" canonical_doc = "ecosystem-a2ml/README.adoc" -source_hash = "sha256:a0d9c7728e32a36d4eaa0ddf22bb2fc7b60a85e9b50d267673e1abb2e2ef94c9" +source_hash = "sha256:7fbd11721e97bd85f8200db8a75267be4d7347f82ad0226e9b1296c92d47f9f2" route = "ecosystem-positioning metadata format" [[spec]] @@ -99,7 +99,7 @@ name = "AGENTIC.a2ml spec" stream = "foundation" home = "agentic-a2ml/" canonical_doc = "agentic-a2ml/README.adoc" -source_hash = "sha256:b95623f7df243aed2c791c327790cfc4d28fc61a3163625ac6c41e85d8c0f83e" +source_hash = "sha256:025e72fc7cbddeeb4e92b3d1aedd74e812f164644dd9ecd26010e4ff26a74c3a" route = "AI-agent operational gating / entropy budgets" [[spec]] @@ -108,7 +108,7 @@ name = "NEUROSYM.a2ml spec" stream = "foundation" home = "neurosym-a2ml/" canonical_doc = "neurosym-a2ml/README.adoc" -source_hash = "sha256:be62099578501b961a948d2218e4ab07ee2b575d8affd03724df493fb63d2e8e" +source_hash = "sha256:753f11a288d6402296a6dc2fc69c0cca986e164d6319b7b789e159995816ec61" route = "symbolic semantics / proof obligations" [[spec]] @@ -117,7 +117,7 @@ name = "PLAYBOOK.a2ml spec" stream = "foundation" home = "playbook-a2ml/" canonical_doc = "playbook-a2ml/README.adoc" -source_hash = "sha256:eb5a05e3853039b03e1f2376a1711365e2b9f657befe55fbfb4aa6d87a5d9eb3" +source_hash = "sha256:fa6ca3574c64d2c03851fee9a0b5ab28b16eb81ce605690f95571640a577b218" route = "executable operational runbooks" [[spec]] @@ -126,7 +126,7 @@ name = "ANCHOR.a2ml spec" stream = "foundation" home = "anchor-a2ml/" canonical_doc = "anchor-a2ml/README.adoc" -source_hash = "sha256:3948f88c03367bd21992dd068b6ea4d0a9c86a98ea6a51567eaff4990df9a70a" +source_hash = "sha256:d33c7ff6c44dc734eb8fd05bd5c7491176da20237b0a5d8212df25471e6b2765" route = "project-recalibration intervention format" [[spec]] @@ -162,7 +162,7 @@ name = "AXEL Protocol" stream = "protocol" home = "axel-protocol/" canonical_doc = "axel-protocol/README.adoc" -source_hash = "sha256:b0b7c07f4d63aa11557fa53d289010826bd5d84cb48489ee1f708af5d9c639dc" +source_hash = "sha256:e5107e43de348a9aecb9991e33bf066fefcc2b4738925140ea91a2fde627c56d" route = "age-gating + explicit-content enforcement" [[spec]] @@ -180,7 +180,7 @@ name = "ARG — Adoption Readiness Grades" stream = "readiness" home = "adoption-readiness-grades/" canonical_doc = "adoption-readiness-grades/README.adoc" -source_hash = "sha256:8943491cf3991b8c6fd5a53bd83657c63978592510cbe79996b4034ab34ae40d" +source_hash = "sha256:89999392cd908835ea7aa0e8ccbdefbdeacab7bc012c4f040aadc811f9caf587" route = "per-language adoption-maturity profile templates" [[spec]] @@ -189,7 +189,7 @@ name = "FRG — Foundations Readiness Grades" stream = "readiness" home = "foundations-readiness-grades/" canonical_doc = "foundations-readiness-grades/README.adoc" -source_hash = "sha256:af968fdd30947f20898895497dcba7b40850e84d35b5b384ef6d0e509ab6afbd" +source_hash = "sha256:e8cd80df1620ee6cb95a68758c7c51a6406ebbd46cb60e4c8e83cc5d771fa83e" route = "per-language foundational-maturity profile templates" [[spec]] @@ -198,7 +198,7 @@ name = "CRG — Component Readiness Grades" stream = "readiness" home = "component-readiness-grades/" canonical_doc = "component-readiness-grades/README.adoc" -source_hash = "sha256:30a65855c396c43955d3abf77623ecec5932347c9ff83b6ab510b99176acec83" +source_hash = "sha256:a101418a64260691a18f696cd388f6a254a46b73ae680c6e3d1cf46788a3d7a2" route = "the X..A grading system for components" [[spec]] @@ -207,7 +207,7 @@ name = "TRG — Toolchain Readiness Grades" stream = "readiness" home = "toolchain-readiness-grades/" canonical_doc = "toolchain-readiness-grades/README.adoc" -source_hash = "sha256:6290b871c14e8e15ebc07602400bf49deba27724b70dced8e0c0ed7e44859fe5" +source_hash = "sha256:9f88c4e947226a0c53a419458949533eb84c2d7e8a343cb2d547ccca880939b6" route = "per-toolchain readiness profile templates" [[spec]] @@ -243,7 +243,7 @@ name = "ENSAID Config" stream = "governance" home = "ensaid-config/" canonical_doc = "ensaid-config/README.adoc" -source_hash = "sha256:1a5b75d3459b63bf7f3ced7eb8b7e7372c08c3b1d6fbaac6da98d008250d9020" +source_hash = "sha256:c56e9784c957b9bd29704d41cbf7d88b1495789e0ad1c628de42abe900d319ef" route = "the ensaid configuration standard" [[spec]] @@ -288,7 +288,7 @@ name = "A2ML Templates" stream = "integration" home = "a2ml-templates/" canonical_doc = "a2ml-templates/STATE.a2ml.v2.spec.adoc" -source_hash = "sha256:1cd30a08f73b51804af7adb3862c20983b97d30542cc7ff2a653fec4ff4e0063" +source_hash = "sha256:ff30b8e1e7c5d4dcf12d17789e40064b632c92bca3d8c2f891f109dc9157dc4a" route = "copy-in templates for the 7 A2ML files" [[spec]] diff --git a/.machine_readable/scorecards/0-ai-gatekeeper-protocol.scorecard.a2ml b/.machine_readable/scorecards/0-ai-gatekeeper-protocol.scorecard.a2ml index 43b66da2..4981f53c 100644 --- a/.machine_readable/scorecards/0-ai-gatekeeper-protocol.scorecard.a2ml +++ b/.machine_readable/scorecards/0-ai-gatekeeper-protocol.scorecard.a2ml @@ -32,6 +32,7 @@ id = "M3" text = "The repository's own machine-readable state MUST accurately reflect this repository (not stale template boilerplate), since the manifest itself declares 'No stale metadata' as a Core Invariant." system = "none" status = "fail" +check = "true" effects = "/home/user/standards/0-ai-gatekeeper-protocol/.machine_readable/6a2/STATE.a2ml declares project = \"rsr-template-repo\" (name = \"Rsr Template Repo\", completion-percentage = 5, generic scaffolding actions like 'Define project scope and objectives'), i.e. it is an un-edited template copy, not this repo's actual state — directly violating the protocol's own 'no stale metadata' invariant it asks every other repo to uphold. Any agent trusting STATE.a2ml for context (as the manifest's own Session Startup Checklist instructs) would be misled about project identity/status, undermining the protocol's core value proposition." [[must]]