From e6c20dd95fc964383a2709e51f50f6c2d253c961 Mon Sep 17 00:00:00 2001 From: amcheste-ai-agent <278991699+amcheste-ai-agent@users.noreply.github.com> Date: Mon, 20 Jul 2026 14:10:08 -0400 Subject: [PATCH 1/2] fix(ci): grant pull-requests read to Gitleaks caller reusable-gitleaks.yml (v1.1.1+) requests pull-requests: read at the workflow level, needed by gitleaks-action to list a PR's commits and compute its scan range. A reusable workflow can only downgrade the caller's token, so without this grant the run fails at startup. Co-Authored-By: Claude Sonnet 5 Co-Authored-By: amcheste <13696614+amcheste@users.noreply.github.com> --- .github/workflows/gitleaks.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/gitleaks.yml b/.github/workflows/gitleaks.yml index fdb2ccd..cc738e9 100644 --- a/.github/workflows/gitleaks.yml +++ b/.github/workflows/gitleaks.yml @@ -13,6 +13,7 @@ on: permissions: contents: read + pull-requests: read jobs: gitleaks: From 0fceea44b21c5a7032dd7b21be86a181b328988f Mon Sep 17 00:00:00 2001 From: amcheste-ai-agent <278991699+amcheste-ai-agent@users.noreply.github.com> Date: Mon, 20 Jul 2026 14:10:09 -0400 Subject: [PATCH 2/2] fix(ci): grant security-events/id-token write to Scorecard caller read-all looks generous but grants nothing for id-token (it has no read level, only none/write), so the analysis job's id-token: write request was denied entirely and every run failed at startup. Replaces it with the explicit grant the reusable workflow's own doc documents. Co-Authored-By: Claude Sonnet 5 Co-Authored-By: amcheste <13696614+amcheste@users.noreply.github.com> --- .github/workflows/scorecard.yml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 7b5b54d..d13b0d5 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -12,7 +12,11 @@ on: branches: [main, develop] workflow_dispatch: -permissions: read-all +permissions: + security-events: write + id-token: write + contents: read + actions: read jobs: scorecard: