From 7b6f355272e1f93a47d4ecc5ed64fa372c6d6396 Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Mon, 6 Jul 2026 22:36:32 +0100
Subject: [PATCH] fix(ci): make OSSF Scorecard caller valid (perms / drop
 timeout-minutes)

Reusable scorecard caller failed at startup: needed security-events+id-token
(reusable perms capped to caller grant) and/or an illegal timeout-minutes on the
uses: job. Verified with actionlint. Pin preserved.
---
 .github/workflows/scorecard.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 5484457..8be8a50 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -14,3 +14,7 @@ permissions:
 jobs:
   scorecard:
     uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@5a93d9d57cc04de4002d6d0ecd336fc7a8698910
+    permissions:
+      contents: read
+      security-events: write
+      id-token: write