fix(ci): drop unneeded actions:read from secret-scanner reusable — fixes Secret Scanner startup_failure - #529
Merged
Conversation
…xes startup_failure rust-secrets and shell-secrets carry no job-level permissions block, so they inherited the reusable top-level `actions: read` + `contents: read`. A caller that grants its scan job only `contents: read` (least-privilege, e.g. standards own secret-scanner.yml) then requested `actions: read` beyond the caller grant, so every run died at startup_failure — the same caller-under-grant rule that had Hypatia never executing. Secret scanners only read file contents (checkout + grep); none calls the Actions API. Dropping `actions: read` from the reusable top-level makes the default least-privilege, greens standards Secret Scanner, and fixes every estate caller granting only contents:read. Reducing a reusable declared permissions can only help the caller-grant check, never break a working caller. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
hyperpolymath
marked this pull request as ready for review
July 27, 2026 13:05
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The red
Secret Scanneron main isstartup_failure— zero jobs, no logs. Root cause is the caller-under-grant rule (the same one that had Hypatia never executing):secret-scanner-reusable.ymldeclares top-levelpermissions: actions: read, contents: read.gitleaksoverrides tocontents: read, butrust-secretsandshell-secretshave no job-level permissions block, so they inherit the top-level and requestactions: read.secret-scanner.yml, and the least-privilege estate default) grants its scan job onlycontents: read.The fix
Drop
actions: readfrom the reusable's top-level permissions (one line). Both secret-scanner jobs onlycheckout+ grep file contents — none calls the Actions API — soactions: readwas never needed.contents: read).contents: read, not just this repo — and reducing a reusable's declared permissions can only ever help the caller-grant check, never break a caller that already worked.Verified: exactly one line removed, YAML still parses,
gitleaks's explicitcontents: readoverride is untouched, the only remainingactions: readstrings are in the file's historical comments.Refs the Secret Scanner
startup_failurenoted in the 2026-07-27 standards sitrep.