From 8c88155f4d3488ac1aa76bb3c552ae9fcb125dd8 Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Tue, 4 Aug 2026 05:14:26 +0100
Subject: [PATCH] fix(ci): grant scorecard caller the reusable's job-level
 permissions

scorecard-reusable's job (not just its workflow header) requests
security-events: write and id-token: write; caller-side permission
validation applies at job level too, so OSSF Scorecard remained
startup_failure after #342 fixed the workflow-level grants.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .github/workflows/scorecard.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index a5f737e4..51152ca5 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -12,6 +12,8 @@ on:
 permissions:
   actions: read
   contents: read
+  id-token: write
+  security-events: write
 
 jobs:
   analysis: