fix(ci): grant 'actions: read' to reusable-workflow callers - #14
Merged
Conversation
These workflows fail with startup_failure - rejected before any job starts, so zero jobs and NO check run, which is why the API cannot report a reason. Cause, from the GitHub web-UI banner: Error calling workflow 'hyperpolymath/standards/.github/workflows/ governance-reusable.yml@...'. The workflow is requesting 'actions: read', but is only allowed 'actions: none'. A called reusable workflow cannot request MORE permission than its caller grants. The standards reusables declare 'actions: read' for their staleness check, which reads workflow runs via the Actions API; these callers granted only 'contents: read'. Patched: governance hypatia-scan scorecard mirror - only the callers that actually mismatch. rust-ci and secret-scanner require no more than they are given and are left untouched. PROVEN by paired control on hyperpolymath/rsr-template-repo: with the grant, Governance runs 11 jobs and reports 'failure'; without it, 0 jobs and 'startup_failure'. Fixed at the template in rsr-template-repo#42 so future mints inherit the correct callers. Same class as standards#527 (2026-07-27). Repos that already grant 'actions: read' - gossamer, IDApTIK, progblocks, canonical-ums, burble, cadastra, chronicles-of-slavia, stapeln - were already executing these workflows, which is what made the difference look like a lockfile issue. It is not; that theory was tested and disproved.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
These workflows fail with
startup_failure— rejected before any job starts, so zero jobs and no check run, which is why the API cannot report a reason.Cause, from the web-UI banner:
A called reusable workflow cannot request more permission than its caller grants. The standards reusables declare
actions: read(staleness check reads workflow runs); these callers granted onlycontents: read.Patched: governance hypatia-scan scorecard mirror — only the callers that actually mismatch.
rust-ciandsecret-scannerneed no more than they are given and are untouched.Proven by paired control on
rsr-template-repo: with the grant, Governance runs 11 jobs and reportsfailure; without it, 0 jobs andstartup_failure. Fixed at source in rsr-template-repo#42.Same class as standards#527. Repos already granting
actions: read(gossamer, IDApTIK, progblocks, canonical-ums, burble, cadastra, chronicles-of-slavia, stapeln) were already executing these workflows — which is what made the difference look like a lockfile issue. It is not; that theory was tested and disproved.