From 2e35453879bf9430938946474a97926761790ee8 Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Tue, 21 Jul 2026 05:35:39 +0100
Subject: [PATCH] fix(ci): grant the secret-scanner reusable its required job
 permissions
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The `scan` job calls secret-scanner-reusable.yml, whose `gitleaks` job
declares `pull-requests: write` (PR summary comment) and `actions: read`
(workflow-run metadata) at job level. A called reusable workflow may only
request permissions equal to or more restrictive than its caller. This
caller granted only the file-level `contents: read`, so GitHub refused the
run at parse time and every Secret Scanner run ended in `startup_failure` —
secret scanning has not actually executed in this repo since the pin landed.

Grants the superset at job level, matching the canonical template and the
176 estate repos whose scanner already runs. No SHA pin is changed.
---
 .github/workflows/secret-scanner.yml | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml
index e2e2af8..9d815d1 100644
--- a/.github/workflows/secret-scanner.yml
+++ b/.github/workflows/secret-scanner.yml
@@ -11,6 +11,13 @@ permissions:
   contents: read
 jobs:
   scan:
+    # The reusable's gitleaks job requests pull-requests: write (PR summary
+    # comment) and actions: read (workflow-run metadata) at job level; the
+    # caller must grant at least that or the run startup-fails.
+    permissions:
+      contents: read
+      pull-requests: write
+      actions: read
     uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236
     secrets: inherit
   trufflehog: