fix(ci): repair unparseable permissions scalar (1 workflow file(s))

[hyperpolymath]

permissions: read-all followed by an indented actions: read is a YAML
parse error. The workflow never starts, so it emits no check run — a
required context silently never reports, and this repository currently looks
greener than a repaired one.

read-all already grants actions: read, so removing the stray line is a
semantic no-op. Each file was verified with a real YAML parser: it fails
yq before the change and parses after it. Every diff is exactly one deleted line.

Files changed: workflow-linter.yml

Measured estate-wide: 42 such files across 28 repositories on main, all
carrying the identical stray key. Zero overlap with the TokenPermissions sweep.

🤖 Generated with Claude Code

https://claude.ai/code/session_0178nN4Nm3neFRy5K9StZKnB

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 2c9a339a-5158-4dd1-8adf-e9154e398570

📥 Commits

Reviewing files that changed from the base of the PR and between cbf9814 and 6ac1299.

📒 Files selected for processing (1)

• .github/workflows/workflow-linter.yml

💤 Files with no reviewable changes (1)

• .github/workflows/workflow-linter.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (31)

• GitHub Check: scan / gitleaks
• GitHub Check: scan / shell-secrets
• GitHub Check: scan / rust-secrets
• GitHub Check: governance / Workflow security linter
• GitHub Check: governance / Exemption ratchet
• GitHub Check: governance / Code quality + docs
• GitHub Check: governance / Licence consistency
• GitHub Check: governance / Actions lockfile verify
• GitHub Check: governance / Language / package anti-pattern policy
• GitHub Check: governance / Debt ratchet
• GitHub Check: governance / Trusted-base reduction policy
• GitHub Check: governance / Allowlist Preflight
• GitHub Check: governance / Well-Known (RFC 9116 + RSR)
• GitHub Check: governance / Live Actions policy (credentialed advisory)
• GitHub Check: governance / Security policy checks
• GitHub Check: governance / Guix packaging policy (Nix retired)
• GitHub Check: governance / Check Workflow Staleness
• GitHub Check: analyze (actions, none)
• GitHub Check: analyze (cpp, none)
• GitHub Check: Hypatia Neurosymbolic Analysis
• GitHub Check: verify-z3 (exact-result oracle)
• GitHub Check: Empty-linter (invisible characters)
• GitHub Check: verify-proofs (Coq build oracle)
• GitHub Check: docs/ECHO-TYPES-OCHRANCE-BRIDGE forbidden-phrases
• GitHub Check: validate-correspondence
• GitHub Check: Validate eclexiaiser manifest
• GitHub Check: Groove manifest check
• GitHub Check: Validate A2ML manifests
• GitHub Check: property-testing
• GitHub Check: Validate K9 contracts
• GitHub Check: lint-workflows

---

📝 Summary

Summary by CodeRabbit

• Chores
  • Simplified workflow permission configuration while retaining read-only access.

Walkthrough

The workflow removes the explicit actions: read entry. It retains the top-level permissions: read-all declaration.

Changes

Workflow permissions

Layer / File(s)	Summary
Remove redundant permission entry .github/workflows/workflow-linter.yml	The workflow now relies on permissions: read-all for read-only access to all token scopes.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~2 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 6ac12

The permission cleanup is ready to merge.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the CI permissions parsing fix. The file count is minor noise but does not reduce clarity.
Description check	✅ Passed	The description explains the YAML parse error, the workflow impact, and the semantic effect of removing the stray line. It directly matches the changeset.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks the workflow gate
One less permission line to state
Read-only scopes remain in view
The linter keeps its path true
Small changes make the config neat}

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🔍 Hypatia Security Scan

Findings: 57 issues detected

Severity	Count
🔴 Critical	9
🟠 High	10
🟡 Medium	38

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Issue in label-triage.yml",
    "type": "missing_timeout_minutes",
    "file": "label-triage.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in labels.yml",
    "type": "missing_timeout_minutes",
    "file": "labels.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Required file missing (condition: public_repo)",
    "type": "missing_requirement",
    "file": "SECURITY.md",
    "action": "create",
    "rule_module": "cicd_rules",
    "severity": "high"
  },
  {
    "line": 44,
    "reason": "job in .github/workflows/push-email-notify.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring",
    "type": "RE001",
    "file": ".github/workflows/push-email-notify.yml",
    "action": "report",
    "rule_module": "research_extensions",
    "severity": "warn"
  },
  {
    "line": 83,
    "reason": "job in .github/workflows/hypatia-scan.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring",
    "type": "RE001",
    "file": ".github/workflows/hypatia-scan.yml",
    "action": "report",
    "rule_module": "research_extensions",
    "severity": "warn"
  },
  {
    "line": 45,
    "reason": "job in .github/workflows/cflite_pr.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring",
    "type": "RE001",
    "file": ".github/workflows/cflite_pr.yml",
    "action": "report",
    "rule_module": "research_extensions",
    "severity": "warn"
  },
  {
    "line": 52,
    "reason": "job in .github/workflows/label-triage.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring",
    "type": "RE001",
    "file": ".github/workflows/label-triage.yml",
    "action": "report",
    "rule_module": "research_extensions",
    "severity": "warn"
  },
  {
    "line": 38,
    "reason": "job in .github/workflows/labels.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring",
    "type": "RE001",
    "file": ".github/workflows/labels.yml",
    "action": "report",
    "rule_module": "research_extensions",
    "severity": "warn"
  },
  {
    "line": 46,
    "reason": "job in .github/workflows/cflite_batch.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring",
    "type": "RE001",
    "file": ".github/workflows/cflite_batch.yml",
    "action": "report",
    "rule_module": "research_extensions",
    "severity": "warn"
  },
  {
    "line": 20,
    "reason": "job in .github/workflows/instant-sync.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring",
    "type": "RE001",
    "file": ".github/workflows/instant-sync.yml",
    "action": "report",
    "rule_module": "research_extensions",
    "severity": "warn"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence