fix(ci): correct reusable-workflow caller permissions and inputs - #158
Merged
Merged
Conversation
Contributor
|
Note Currently processing new changes in this PR. This may take a few minutes, please wait... ⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Advanced Run ID: 📒 Files selected for processing (1)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
hyperpolymath
added a commit
that referenced
this pull request
Sep 22, 2026
…nce to standards@fad242d3 (#163) (#164) Cures the three reds that sit on every push to `main` and every PR, so that a PR can be fully green again. Closes #160. Closes #163. ## What changes | file | change | why | |---|---|---| | `.github/workflows/deno-ci.yml` | deleted | Deno is banned estate-wide (bun is the runtime); the workflow ran on every PR and failed. #160 | | `examples/web-project-deno.json` | deleted | the only Deno artefact; nothing else references it. #160 | | `.github/workflows/governance.yml` | pin `bd0df9ea` → `fad242d35291de1898242d6737ba02b74a59a2f2` (standards main 2026-09-07, post-#742) | the pin tropical-types and nextgen-typing are green on. #163 | | `.github/workflows/actions.lock` | drop the `deno-ci.yml: []` key | the workflow no longer exists | `.github/CONTRIBUTING.md` stays where it is: `check-docs-presence.sh` at the new pin accepts that path and names it the canonical location, so no move was needed. ## How each #163 red is cured (measured, not assumed) - **Allowlist Preflight** — at `fad242d3` the live-policy probe is a separate credentialed advisory job (`actions-policy-live`) that emits `::warning::` and never `exit 1`; `allowlist-preflight` no longer needs `HYPATIA_SCAN_PAT` (declared `required: false`). - **Workflow security linter** — the SPDX predicate now scans the whole leading comment block, so the `# managed by gh actions-lock` line 1 no longer hides the `SPDX-License-Identifier` on line 2. Ran the exact predicate over all 16 workflows on this branch: 0 failures. Also ran the three new steps' scripts locally (`check-workflows-parse.sh`, `check-workflow-duplicate-keys.sh` at `fad242d3`; `check-action-pins-resolve.sh` from main): all 16 parse, 16 clean, 3/3 pins resolve. - **Code quality + docs** — `check-docs-presence.sh` passes with CONTRIBUTING under `.github/` (`✅ Core documentation present`). Other gates at the new pin, run locally against this branch: - `check-actions-lock-gate.sh` with `update-actions-lock.sh --verify-local` (the `actions-lock-verify` job): `valid: true`, transitive coverage verified. One pre-existing advisory `sha-as-ref` note on `push-email-notify.yml`'s bare-SHA ref, not a failure. - exemption ratchet vs `origin/main`: unchanged (`.hypatia-ignore` 9, `root-allow.txt` 1), OK. Debt ratchet: no Debtfile, nothing to ratchet. - `check-ts-allowlist.sh`, `check-language-policy.sh` (the two new language-policy steps): both pass. Tracked `*.v` files are Coq; the V-lang rule keys on `v.mod`/`vpkg.json` only. **Lock-free bump:** every step-level action inside `governance-reusable.yml@fad242d3` (checkout `3d3c42e5`, cache `55cc8345`, editorconfig `840e866d`, setup-beam `54075bcc`) is already in `actions.lock` at that SHA. Standards HEAD would bump editorconfig to `51f63319` and force a lock regeneration; deliberately not taken. ## Note on the `Rust CI` check `rust-ci-reusable.yml@bd0df9ea`'s detect job checks out `refs/pull/N/merge`. When a PR is merged within seconds of opening, the merge ref is gone by the time the queued job starts and the check fails on `Checkout repository` (that is what happened to #158 and #159; #157, held open, passed). Holding this PR open until every check is green avoids the race; a pin bump to a reusable with the `github.sha` cure is a separate follow-up. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01QYY8Gp4v4x2J7iSNn1vZ57 Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
hyperpolymath
added a commit
that referenced
this pull request
Sep 22, 2026
## What `.github/workflows/scorecard.yml` has died at startup on every run since 2026-09-07 (`startup_failure`, jobs=0; #168 counts 20). This PR rewrites the caller in the shape of the standards canonical caller and pins the callee to a revision that actually uploads SARIF. Refs #168 — not closed here: its AC3 is a Scorecard analysis on `main`, which only the post-merge `push: main` run can produce. ## Root cause (read from the run page; the API carries no log for a jobs=0 run) > The workflow is not valid. .github/workflows/scorecard.yml (Line: 15, Col: 3): Error calling workflow 'hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@bd0df9ea…'. The workflow is requesting 'actions: read, contents: read', but is only allowed 'actions: none, contents: none'. A job-level `permissions:` block **replaces** the workflow-level map. The job carried only `security-events: write` + `id-token: write`, so `permissions: read-all` at the workflow level did nothing for it, and the callee's `actions: read` / `contents: read` were refused at startup. #158 (a551037, 09-21) added the two scopes to the job block, but nothing has exercised the file since: it triggered only on `branch_protection_rule` and a weekly cron (`23 4 * * 1`, next 09-28) and had no `workflow_dispatch`. ## Change | | before (main 828399a) | after | |---|---|---| | workflow `permissions` | `read-all` | `contents: read` (standards shape) | | job `permissions` | four scopes (since #158) | four scopes (unchanged) | | triggers | `branch_protection_rule`, cron | + `push: main`, `pull_request`, `workflow_dispatch` | | concurrency | none | `${{ github.workflow }}-${{ github.ref }}`, cancel-in-progress | | callee pin | standards `bd0df9ea` — `results_format: json`, no SARIF upload, so no analysis even when green | standards `0f13f51f` — `results_format: sarif` + `upload-sarif`, PR lane in Local mode; green on standards push run 35794990055 and pull_request run 35795130513 | | `secrets: inherit` | yes | dropped — the callee references no `secrets.` | | `actions.lock` key | `'.github/workflows/scorecard.yml': []` | unchanged; a callee's steps are not validated against the caller's lock (hypatia-scan is the control). `gh actions-lock --verify-local`: 16/16 workflows covered | Deliberate differences from the standards caller: the cross-repo SHA pin, this repo's existing cron, and the `branch_protection_rule` trigger (kept, not mine to drop). The workflow `name` is unchanged so check-run history is not orphaned. ## Evidence (all three dispatched 2026-09-22T23:26:30Z) | branch | shape | run | result | |---|---|---|---| | `fix/168-scorecard-caller` 6f01307 (this PR) | cure | 35797429801 | **passed startup**, jobs=2. `Run Scorecard` then failed inside `ossf/scorecard-action`: `refs/heads/fix/168-scorecard-caller not supported with workflow_dispatch event. Only the default branch main is supported.` The action refuses non-default branches by design; its supported lanes are `pull_request` (this PR's check) and `push: main` (after merge). | | `mutant/168-a-readall-two-scopes` 45f97fb | `read-all` + a job block of only `security-events`/`id-token` (the pre-#158 shape) | 35797435300 | **`startup_failure`, jobs=0**: "The nested job 'scorecard' is requesting 'actions: read, contents: read', but is only allowed 'actions: none, contents: none'." The diagnosed cause, reproduced one-variable. | | `mutant/168-b-readall-four-scopes` 867847c | `read-all` + four job scopes (issue #168's own AC4 mutant) | 35797440576 | **passed startup**, then the same in-action refusal as the cure. So `read-all` alone was never the killer, #158's job block had already cured startup, and the AC4 mutant as written in the issue was the wrong shape. | The mutant branches are deleted; the runs persist. ## What the PR lane must show before this merges - `scorecard / Run Scorecard PR` green on `refs/pull/N/merge` (Local mode, `publish_results: false`), and a `Scorecard` entry under `code-scanning/analyses` for the PR ref. - Every rule of ruleset 18110203 passing: `required_status_checks`, `code_scanning` (CodeQL, Hypatia, Scorecard), `required_signatures`, review-thread resolution. Auto-merge by squash is armed only once every check is green (D87); nothing is merged over a red. - After merge: the `push: main` run produces the `Scorecard` analysis on `main` (#168 AC3), and `workflow_dispatch` on `main` works (the action supports the default branch). 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01QYY8Gp4v4x2J7iSNn1vZ57 Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
5 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two proven fatal classes, both confirmed by GitHub's own error text:
permissions:nested underwith:— it is read as a workflow input, and undeclared inputs are rejected at creation (Invalid input, toolchain is not defined in the referenced workflow— januskey run 34410358241). The block is moved to job level, and the undeclaredtoolchaininput is dropped (rust-ci-reusable declares runs-on/enable_audit/enable_coverage/coverage_floor/clippy_args/test_args/check_args/working_directory).Error calling workflow … requesting '<perm>', but is only allowed '<none>'. The job now grants the canonicalactions: read,contents: read,security-events: write.Verified with
git apply --checkagainst currentmainbefore opening.