From 283ae1d848d9f7f88ba0f061ac1e7298e51d7664 Mon Sep 17 00:00:00 2001 From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com> Date: Mon, 14 Sep 2026 21:52:11 +0100 Subject: [PATCH] fix(ci): grant actions: read in the Scorecard reusable, and correct its contract comment MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Two related defects, one root cause. 1. THE REUSABLE'S OWN JOB BLOCK omitted `actions: read`. A called workflow's job-level permissions narrow the token just as a caller's do, so even a caller that grants `actions: read` ended up with `actions: none` here. Scorecard's Packaging check calls Actions.ListWorkflowRunsByFileName and errors without it. 2. THE HEADER COMMENT named only three permissions callers must grant, omitting `actions: read`. That comment is the contract consumers copy from, so the omission propagated: audited across the estate on 2026-09-14, 11 of 13 scorecard.yml callers lack `actions: read` — including the repo whose file was used as the canonical model. The comment now also states why the declarations here cannot rescue a caller: a job-level `permissions:` block REPLACES the workflow-level one rather than merging with it. Caller-side repairs are in flight separately (13 PRs). Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_0178nN4Nm3neFRy5K9StZKnB --- .github/workflows/scorecard-reusable.yml | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/.github/workflows/scorecard-reusable.yml b/.github/workflows/scorecard-reusable.yml index 0ab298c5a..943517733 100644 --- a/.github/workflows/scorecard-reusable.yml +++ b/.github/workflows/scorecard-reusable.yml @@ -6,7 +6,12 @@ name: OSSF Scorecard Reusable Workflow on: workflow_call: -# Callers must grant contents: read, security-events: write and id-token: write. +# Callers must grant actions: read, contents: read, security-events: write and +# id-token: write ON THE CALLING JOB. A job-level `permissions:` block REPLACES +# the workflow-level one and is never merged with it, so the declarations below +# cannot elevate a caller that omitted them. `actions: read` is required by +# Scorecard's Packaging check (Actions.ListWorkflowRunsByFileName); without it +# the check errors. Audited 2026-09-14: 11 of 13 callers in the estate omitted it. # Only default-branch publication receives OIDC; PR analysis cannot publish # unmerged results to the public Scorecard dataset or badge. permissions: @@ -19,6 +24,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 15 permissions: + actions: read contents: read security-events: write id-token: write