fix(ci): clear OSSF Scorecard startup_failure - #75
Merged
Conversation
Reusable scorecard caller failed at startup: needed security-events+id-token (reusable perms capped to caller grant) and/or an illegal timeout-minutes on the uses: job. Verified with actionlint. Pin preserved.
hyperpolymath
enabled auto-merge (squash)
July 6, 2026 21:38
hyperpolymath
disabled auto-merge
July 6, 2026 22:38
hyperpolymath
added a commit
that referenced
this pull request
Jul 27, 2026
) Closes the two remaining red workflows on `main` and removes a stray licence file. Three independent defects, each root-caused against the live runs. ## 1. `comprehensive-quality.yml` — duplicate top-level key (parse-dead) The file declared `permissions: read-all` **twice**, at lines 4 and 12. GitHub Actions rejects a workflow with duplicate top-level keys, so it never parsed. The tell: the run reported as the raw path `.github/workflows/comprehensive-quality.yml` instead of its `name:` (`Comprehensive Quality Gates`) — GitHub never read far enough to find the name — with **zero jobs** and `log not found`. Removed the second occurrence. Both were `read-all`, so **no semantic change**. > **Linting note worth keeping:** `yaml.safe_load` reports this file as > perfectly valid, because PyYAML applies last-wins on duplicate keys. Any > workflow linter built on a stock YAML parser is blind to this entire class of > defect. Detection needs a loader with an explicit duplicate-key constructor. ## 2. `scorecard.yml` — reusable permission escalation (`startup_failure`) A job-level `permissions:` block **replaces** the default grant rather than extending it. Granting only `security-events: write` + `id-token: write` therefore left `contents` at **none**. The reusable (`standards/.github/workflows/scorecard-reusable.yml@81dbf2dd`) declares `permissions: contents: read` at `workflow_call` level, and a reusable may not request more permission than its caller holds — so the job never started. Added `contents: read`, with an inline comment so it doesn't regress. This is the estate-wide pattern tracked in standards#527. Note that #75 aimed at this symptom and did not clear it; this addresses the actual grant. ## 3. `LICENSES/AGPL-3.0-or-later.txt` — removed Nothing in the repo declares `AGPL-3.0`. The canonical pair is **MPL-2.0 + CC-BY-SA-4.0**, normalised deliberately in #69, and every manifest agrees (`Cargo.toml`, `codemeta.json`, `CITATION.cff`; `LICENSE` is the MPL-2.0 text). The repo's own machine-readable policy is explicit: ``` .machine_readable/6a2/AGENTIC.a2ml:23 # - Never use AGPL license (use MPL-2.0) ``` Sweep residue from `b9aaa6b`, landed on `main` via #83. ## Verification - Strict duplicate-key scan passes across **all 19** workflow files (was 1 failing). - `comprehensive-quality.yml` parses to `Comprehensive Quality Gates`, 11 jobs. - `scorecard.yml` job `analysis` resolves to `{contents: read, security-events: write, id-token: write}`. - The real test is CI on this PR — please confirm both workflows now start. ## Out of scope, but found — worth a follow-up - `RSR_COMPLIANCE.adoc:56` and `RSR_OUTLINE.adoc:74,162` describe the licensing as **"LICENSE.txt (AGPL + Palimpsest)"**. That contradicts the repo's actual MPL-2.0 licensing *and* its own no-AGPL policy, and `LICENSE.txt` does not exist (the file is `LICENSE`). Looks like unedited RSR template boilerplate. Left alone deliberately — rewriting compliance docs is a judgement call. - Three Pages workflows (`pages.yml`, `casket-pages.yml`, `jekyll-gh-pages.yml`) all deploy on push to `main` — three deployers racing for one environment. Draft pending CI. Context: `dev-notes/betlang-sitrep-2026-07-27.md`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes the OSSF Scorecard workflow, which failed at startup on every run.
Cause: reusable-workflow caller missing
security-events: write+id-token: write(reusable perms are capped by the caller), and/or an illegaltimeout-minuteskey on auses:job.Fix: inject caller permissions and/or drop
timeout-minutes. Pin preserved. Verified with actionlint. Part of an estate-wide Scorecard remediation.🤖 Generated with Claude Code