Hypatia Security Scan #1021

	# SPDX-License-Identifier: MPL-2.0
	name: Hypatia Security Scan

	on:
	push:
	branches: [main, master, develop]
	pull_request:
	branches: [main, master]
	schedule:
	- cron: "0 0 * * 0"
	workflow_dispatch:

	permissions:
	actions: read
	contents: read
	# MUST be `write`, not `read`. hypatia-scan-reusable.yml declares
	# `security-events: write` so it can upload SARIF. A called workflow may
	# never request more than its caller grants: if it does, GitHub rejects the
	# run at startup, before any job is created — `startup_failure`, zero jobs,
	# and `gh run view --log-failed` returns "log not found". Granting `read`
	# here did not degrade the scan, it silently prevented it from ever running.
	# See standards#451.
	security-events: write

	jobs:
	scan:
	uses: ./.github/workflows/hypatia-scan-reusable.yml
	secrets: inherit

Provide feedback