From 1a88ca6ed4b6889774a81cd11f504f0be2b5feb4 Mon Sep 17 00:00:00 2001 From: amcheste-ai-agent <278991699+amcheste-ai-agent@users.noreply.github.com> Date: Mon, 20 Jul 2026 14:10:23 -0400 Subject: [PATCH 1/3] fix(ci): grant pull-requests read to Gitleaks caller reusable-gitleaks.yml (v1.1.1+) requests pull-requests: read at the workflow level, needed by gitleaks-action to list a PR's commits and compute its scan range. A reusable workflow can only downgrade the caller's token, so without this grant the run fails at startup. Co-Authored-By: Claude Sonnet 5 Co-Authored-By: amcheste <13696614+amcheste@users.noreply.github.com> --- .github/workflows/gitleaks.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/gitleaks.yml b/.github/workflows/gitleaks.yml index 9890200..07a0d83 100644 --- a/.github/workflows/gitleaks.yml +++ b/.github/workflows/gitleaks.yml @@ -14,6 +14,7 @@ on: permissions: contents: read pull-requests: read + pull-requests: read jobs: gitleaks: From 6b1e3fbe3c8a6d111d837360ddd35284cb916302 Mon Sep 17 00:00:00 2001 From: amcheste-ai-agent <278991699+amcheste-ai-agent@users.noreply.github.com> Date: Mon, 20 Jul 2026 14:10:24 -0400 Subject: [PATCH 2/3] fix(ci): grant security-events/id-token write to Scorecard caller read-all looks generous but grants nothing for id-token (it has no read level, only none/write), so the analysis job's id-token: write request was denied entirely and every run failed at startup. Replaces it with the explicit grant the reusable workflow's own doc documents. Co-Authored-By: Claude Sonnet 5 Co-Authored-By: amcheste <13696614+amcheste@users.noreply.github.com> --- .github/workflows/scorecard.yml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 7b5b54d..d13b0d5 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -12,7 +12,11 @@ on: branches: [main, develop] workflow_dispatch: -permissions: read-all +permissions: + security-events: write + id-token: write + contents: read + actions: read jobs: scorecard: From 8927efd8d907ccf849e19d6693957abda3e3daf6 Mon Sep 17 00:00:00 2001 From: amcheste-ai-agent <278991699+amcheste-ai-agent@users.noreply.github.com> Date: Mon, 20 Jul 2026 22:44:49 -0400 Subject: [PATCH 3/3] fix(ci): remove duplicate pull-requests key in Gitleaks stub MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Same duplicate-key bug as ccc-deploy#15, homelab-agent#13, homelab-provisioning#10, repo-template#41 — my earlier fleet-audit fix blindly appended pull-requests: read without checking it was already present, producing an invalid duplicate YAML key. GitHub can't parse the file, so the pull_request-triggered Gitleaks check never even registered as a run. Co-Authored-By: Claude Sonnet 5 Co-Authored-By: amcheste <13696614+amcheste@users.noreply.github.com> --- .github/workflows/gitleaks.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/.github/workflows/gitleaks.yml b/.github/workflows/gitleaks.yml index 07a0d83..9890200 100644 --- a/.github/workflows/gitleaks.yml +++ b/.github/workflows/gitleaks.yml @@ -14,7 +14,6 @@ on: permissions: contents: read pull-requests: read - pull-requests: read jobs: gitleaks: