fix(ci): correct Gitleaks/Scorecard caller permissions#48
Merged
Conversation
reusable-gitleaks.yml (v1.1.1+) requests pull-requests: read at the workflow level, needed by gitleaks-action to list a PR's commits and compute its scan range. A reusable workflow can only downgrade the caller's token, so without this grant the run fails at startup. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Co-Authored-By: amcheste <13696614+amcheste@users.noreply.github.com>
read-all looks generous but grants nothing for id-token (it has no read level, only none/write), so the analysis job's id-token: write request was denied entirely and every run failed at startup. Replaces it with the explicit grant the reusable workflow's own doc documents. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Co-Authored-By: amcheste <13696614+amcheste@users.noreply.github.com>
amcheste
approved these changes
Jul 21, 2026
Same duplicate-key bug as ccc-deploy#15, homelab-agent#13, homelab-provisioning#10, repo-template#41 — my earlier fleet-audit fix blindly appended pull-requests: read without checking it was already present, producing an invalid duplicate YAML key. GitHub can't parse the file, so the pull_request-triggered Gitleaks check never even registered as a run. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Co-Authored-By: amcheste <13696614+amcheste@users.noreply.github.com>
amcheste
approved these changes
Jul 21, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Same permission-capping bug class as the earlier fleet audit, hitting a fresh batch of repos — these were just converted from the old inline-job CI pattern to the centralized
gh-workflowscaller-stub pattern, and the conversion carried the bug over.pull-requests: read, needed bygitleaks-actionto list a PR's commits and compute its scan range.permissions: read-allwith an explicit grant.read-alllooks generous but grants nothing forid-token(it has no read level, only none/write), so the analysis job'sid-token: writerequest was denied entirely and every run failed at startup.Test plan