fix(ci): repair unparseable permissions scalar (2 workflow file(s))

[hyperpolymath]

permissions: read-all followed by an indented actions: read is a YAML
parse error. The workflow never starts, so it emits no check run — a
required context silently never reports, and this repository currently looks
greener than a repaired one.

read-all already grants actions: read, so removing the stray line is a
semantic no-op. Each file was verified with a real YAML parser: it fails
yq before the change and parses after it. Every diff is exactly one deleted line.

Files changed: e2e.yml scorecard.yml

Measured estate-wide: 42 such files across 28 repositories on main, all
carrying the identical stray key. Zero overlap with the TokenPermissions sweep.

🤖 Generated with Claude Code

https://claude.ai/code/session_0178nN4Nm3neFRy5K9StZKnB

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: e661e149-bc26-4199-9a24-7fc74ac63c00

📥 Commits

Reviewing files that changed from the base of the PR and between e6e74d3 and 087777f.

📒 Files selected for processing (1)

• .github/workflows/e2e.yml

💤 Files with no reviewable changes (1)

• .github/workflows/e2e.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (25)

• GitHub Check: governance / Licence consistency
• GitHub Check: governance / Language / package anti-pattern policy
• GitHub Check: governance / Code quality + docs
• GitHub Check: governance / Allowlist Preflight
• GitHub Check: governance / Check Workflow Staleness
• GitHub Check: governance / Debt ratchet
• GitHub Check: governance / Workflow security linter
• GitHub Check: governance / Exemption ratchet
• GitHub Check: governance / Guix packaging policy (Nix retired)
• GitHub Check: governance / Trusted-base reduction policy
• GitHub Check: governance / Live Actions policy (credentialed advisory)
• GitHub Check: governance / Security policy checks
• GitHub Check: governance / Well-Known (RFC 9116 + RSR)
• GitHub Check: scan / gitleaks
• GitHub Check: scan / shell-secrets
• GitHub Check: hypatia / Hypatia Neurosymbolic Analysis
• GitHub Check: scan / rust-secrets
• GitHub Check: Hypatia neurosymbolic scan
• GitHub Check: panic-attack assail
• GitHub Check: openssf-compliance
• GitHub Check: analyze (javascript-typescript, none)
• GitHub Check: Empty-linter (invisible characters)
• GitHub Check: Validate K9 contracts
• GitHub Check: Groove manifest check
• GitHub Check: Validate A2ML manifests

---

📝 Summary

Summary by CodeRabbit

• Chores
  • Updated automated processes to use read-only access across available permission scopes.
  • No changes to end-user functionality or product behaviour.

Walkthrough

The end-to-end GitHub Actions workflow now uses read-all at workflow level instead of granting read access only to the actions scope.

Changes

Workflow permission scope

Layer / File(s)	Summary
Update workflow permissions .github/workflows/e2e.yml	The workflow-level permission setting changes from actions: read to read-all.

Priority: ➖ Normal

Estimated code review effort: 1 (Trivial) | ~2 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 0a4d0

No concrete current-head workflow risk remains from this change.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the main change: repairing an unparseable permissions value in two workflow files. The wording is concise enough and directly relates to the changes.
Description check	✅ Passed	The description explains the YAML parsing error, the fix, the affected files, the semantic impact, and the validation performed. It does not use the template headings or checklist, but it provides the…
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks the workflow gate
Read-only scopes now set the state
No write permissions cross the line
The end-to-end checks run fine
Soft paws approve the safer design}

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate failed

Failed conditions
C Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE