From d9f5c00be4a2283daa4b427233c22f1545eb5bc5 Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Tue, 21 Jul 2026 05:34:44 +0100
Subject: [PATCH] fix(ci): grant the secret-scanner reusable its required job
 permissions
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The `scan` job calls secret-scanner-reusable.yml, whose `gitleaks` job
declares `pull-requests: write` (PR summary comment) and `actions: read`
(workflow-run metadata) at job level. A called reusable workflow may only
request permissions equal to or more restrictive than its caller. This
caller granted only the file-level `contents: read`, so GitHub refused the
run at parse time and every Secret Scanner run ended in `startup_failure` —
secret scanning has not actually executed in this repo since the pin landed.

Grants the superset at job level, matching the canonical template and the
176 estate repos whose scanner already runs. No SHA pin is changed.
---
 .github/workflows/secret-scanner.yml | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml
index d713d06..8308b58 100644
--- a/.github/workflows/secret-scanner.yml
+++ b/.github/workflows/secret-scanner.yml
@@ -15,5 +15,12 @@ permissions:
 
 jobs:
   scan:
+    # The reusable's gitleaks job requests pull-requests: write (PR summary
+    # comment) and actions: read (workflow-run metadata) at job level; the
+    # caller must grant at least that or the run startup-fails.
+    permissions:
+      contents: read
+      pull-requests: write
+      actions: read
     uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236
     secrets: inherit