fix(ci): grant actions: read in the Scorecard reusable, and correct its contract comment - #788
Merged
Merged
Conversation
…ts contract comment Two related defects, one root cause. 1. THE REUSABLE'S OWN JOB BLOCK omitted `actions: read`. A called workflow's job-level permissions narrow the token just as a caller's do, so even a caller that grants `actions: read` ended up with `actions: none` here. Scorecard's Packaging check calls Actions.ListWorkflowRunsByFileName and errors without it. 2. THE HEADER COMMENT named only three permissions callers must grant, omitting `actions: read`. That comment is the contract consumers copy from, so the omission propagated: audited across the estate on 2026-09-14, 11 of 13 scorecard.yml callers lack `actions: read` — including the repo whose file was used as the canonical model. The comment now also states why the declarations here cannot rescue a caller: a job-level `permissions:` block REPLACES the workflow-level one rather than merging with it. Caller-side repairs are in flight separately (13 PRs). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0178nN4Nm3neFRy5K9StZKnB
Contributor
|
Warning Review limit reachedNext included review available in 58 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Advanced Run ID: 📒 Files selected for processing (1)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
hyperpolymath
enabled auto-merge
September 14, 2026 22:25
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two defects, one root cause
1. The reusable's own job block omitted
actions: readjobs.scorecard.permissionslistedcontents,security-events,id-token— notactions.A called workflow's job-level permissions narrow the token exactly as a caller's do. So even
a caller that correctly granted
actions: readended up withactions: noneinside this job.Scorecard's Packaging check calls
Actions.ListWorkflowRunsByFileNameand errors without it.This means the caller-side repairs alone would not have been sufficient.
2. The header comment stated an incomplete contract
actions: readwas missing. That comment is the contract consumers copy from, so the omissionpropagated outward. Audited 2026-09-14: 11 of 13
scorecard.ymlcallers in the estate lackactions: read— including the repo whose file was used as the canonical model for the repairfamily, where it is already on
main.The comment now also records why the declarations in this file cannot rescue a caller: a
job-level
permissions:block replaces the workflow-level one rather than merging with it.Caller-side repairs
13 PRs in flight separately (
ambientops#345,aerie#78,branch-newspaper#88,ffmpeg-ffi#46,formatrix-docs#55,nesy-solver#66,palimpsest-license#151,panll#120,road-skate#32,snifs#98,bofig#187,Cliometrics.jl#57;gv-clade-index#78already correct).Original catch: CodeRabbit, on
palimpsest-license#151. Verified independently against per-jobpermission semantics and audited across all 13 callers before acting.
Verification
yq:jobs.scorecard.permissions=actions, contents, security-events, id-tokenactionlintclean%G?=G🤖 Generated with Claude Code
https://claude.ai/code/session_0178nN4Nm3neFRy5K9StZKnB