From 8d6d95bf4eacf04dfefc254615b639eb4d5662fe Mon Sep 17 00:00:00 2001 From: "Lutar, Stephen P." Date: Thu, 16 Jul 2026 14:53:52 -0400 Subject: [PATCH] fix(ci): grant reusable-workflow callers their full requested permission set The token-permissions narrowing kept the job-level writes but dropped the read grants (actions:read / contents:read) each pinned org reusable also requests; a reusable job cannot exceed the caller's grant, so runs were rejected at startup. Grants now mirror the reusable's declared set exactly. Signed-off-by: SZL Ops --- .github/workflows/scorecard.yml | 2 ++ .github/workflows/trivy.yml | 1 + 2 files changed, 3 insertions(+) diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 8439df8..92ad91c 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -16,6 +16,8 @@ permissions: jobs: scorecard: permissions: + actions: read + contents: read security-events: write id-token: write uses: szl-holdings/.github/.github/workflows/reusable-scorecard.yml@ebd2128c691b850c84438b671fbb512945933776 diff --git a/.github/workflows/trivy.yml b/.github/workflows/trivy.yml index c8266f4..94cac14 100644 --- a/.github/workflows/trivy.yml +++ b/.github/workflows/trivy.yml @@ -16,6 +16,7 @@ permissions: jobs: trivy: permissions: + contents: read security-events: write uses: szl-holdings/.github/.github/workflows/reusable-trivy.yml@ebd2128c691b850c84438b671fbb512945933776 secrets: inherit