From 9f571bc0b02f438987279b88992d8eab6c73fa2b Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Sat, 19 Sep 2026 19:40:51 +0000 Subject: [PATCH] =?UTF-8?q?fix(ci):=20call=20the=20estate=20reusables=20by?= =?UTF-8?q?=20their=20real=20ref=20=E2=80=94=20root=20and=20nested=20copie?= =?UTF-8?q?s?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `uses: ../….github/workflows/-reusable.yml` is not a ref form GitHub Actions supports, so every workflow carrying it fails at parse time: conclusion=failure, 0 jobs, and a run name equal to its path rather than its declared `name:`. This repairs them throughout the tree, not only in the root `.github/workflows/`, because the root is where they are *live* but the nested copies are where they *propagate* — standards' format templates, k9-ecosystem's dispatch templates and deed-core's action scaffolds are what new repos are minted from, and each one carried an unparseable ref. Each ref becomes the pinned cross-repo form `hyperpolymath/standards/.github/workflows/-reusable.yml@4e6ffe55…`, and each calling job is granted the permissions its callee declares — keyed off the callee named in the ref, since several callers point at the same reusable. Without that step the repair only moves the failure from parse time to run time. Refs hyperpolymath/standards#808. --- actions/validate/.github/workflows/codeql.yml | 6 +++++- actions/validate/.github/workflows/governance.yml | 5 ++++- actions/validate/.github/workflows/hypatia-scan.yml | 6 +++++- actions/validate/.github/workflows/mirror.yml | 5 ++++- actions/validate/.github/workflows/scorecard-enforcer.yml | 5 ++++- actions/validate/.github/workflows/scorecard.yml | 5 ++++- actions/validate/.github/workflows/secret-scanner.yml | 2 +- bindings/deno/.github/workflows/codeql.yml | 6 +++++- bindings/deno/.github/workflows/governance.yml | 5 ++++- bindings/deno/.github/workflows/hypatia-scan.yml | 6 +++++- bindings/deno/.github/workflows/mirror.yml | 5 ++++- bindings/deno/.github/workflows/scorecard-enforcer.yml | 5 ++++- bindings/deno/.github/workflows/scorecard.yml | 5 ++++- bindings/deno/.github/workflows/secret-scanner.yml | 2 +- bindings/haskell/.github/workflows/codeql.yml | 6 +++++- bindings/haskell/.github/workflows/governance.yml | 5 ++++- bindings/haskell/.github/workflows/hypatia-scan.yml | 6 +++++- bindings/haskell/.github/workflows/mirror.yml | 5 ++++- bindings/haskell/.github/workflows/scorecard-enforcer.yml | 5 ++++- bindings/haskell/.github/workflows/scorecard.yml | 5 ++++- bindings/haskell/.github/workflows/secret-scanner.yml | 2 +- bindings/rust/.github/workflows/codeql.yml | 6 +++++- bindings/rust/.github/workflows/governance.yml | 5 ++++- bindings/rust/.github/workflows/hypatia-scan.yml | 6 +++++- bindings/rust/.github/workflows/mirror.yml | 5 ++++- bindings/rust/.github/workflows/scorecard-enforcer.yml | 5 ++++- bindings/rust/.github/workflows/scorecard.yml | 5 ++++- bindings/rust/.github/workflows/secret-scanner.yml | 2 +- editors/vscode/.github/workflows/codeql.yml | 6 +++++- editors/vscode/.github/workflows/governance.yml | 5 ++++- editors/vscode/.github/workflows/hypatia-scan.yml | 6 +++++- editors/vscode/.github/workflows/mirror.yml | 5 ++++- editors/vscode/.github/workflows/scorecard-enforcer.yml | 5 ++++- editors/vscode/.github/workflows/scorecard.yml | 5 ++++- editors/vscode/.github/workflows/secret-scanner.yml | 2 +- pandoc/.github/workflows/codeql.yml | 6 +++++- pandoc/.github/workflows/governance.yml | 5 ++++- pandoc/.github/workflows/hypatia-scan.yml | 6 +++++- pandoc/.github/workflows/mirror.yml | 5 ++++- pandoc/.github/workflows/scorecard-enforcer.yml | 5 ++++- pandoc/.github/workflows/scorecard.yml | 5 ++++- pandoc/.github/workflows/secret-scanner.yml | 2 +- 42 files changed, 162 insertions(+), 42 deletions(-) diff --git a/actions/validate/.github/workflows/codeql.yml b/actions/validate/.github/workflows/codeql.yml index de07c8f..e6bdb0e 100644 --- a/actions/validate/.github/workflows/codeql.yml +++ b/actions/validate/.github/workflows/codeql.yml @@ -18,6 +18,10 @@ permissions: jobs: analyze-js: - uses: ../../../.github/workflows/codeql-reusable.yml + permissions: + actions: read + contents: read + security-events: write + uses: hyperpolymath/standards/.github/workflows/codeql-reusable.yml@4e6ffe5568d7864f540d99c7d4ea9b9250ed30f2 with: language: javascript-typescript diff --git a/actions/validate/.github/workflows/governance.yml b/actions/validate/.github/workflows/governance.yml index f5f282c..bd68b4c 100644 --- a/actions/validate/.github/workflows/governance.yml +++ b/actions/validate/.github/workflows/governance.yml @@ -24,4 +24,7 @@ permissions: jobs: governance: - uses: ../../../.github/workflows/governance-reusable.yml + permissions: + actions: read + contents: read + uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@4e6ffe5568d7864f540d99c7d4ea9b9250ed30f2 diff --git a/actions/validate/.github/workflows/hypatia-scan.yml b/actions/validate/.github/workflows/hypatia-scan.yml index f120579..fbd8812 100644 --- a/actions/validate/.github/workflows/hypatia-scan.yml +++ b/actions/validate/.github/workflows/hypatia-scan.yml @@ -17,5 +17,9 @@ permissions: jobs: scan: - uses: ../../../.github/workflows/hypatia-scan-reusable.yml + permissions: + actions: read + contents: read + security-events: write + uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@4e6ffe5568d7864f540d99c7d4ea9b9250ed30f2 secrets: inherit diff --git a/actions/validate/.github/workflows/mirror.yml b/actions/validate/.github/workflows/mirror.yml index a20ae7d..639988a 100644 --- a/actions/validate/.github/workflows/mirror.yml +++ b/actions/validate/.github/workflows/mirror.yml @@ -11,5 +11,8 @@ permissions: jobs: mirror: - uses: ../../../.github/workflows/mirror-reusable.yml + permissions: + actions: read + contents: read + uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@4e6ffe5568d7864f540d99c7d4ea9b9250ed30f2 secrets: inherit diff --git a/actions/validate/.github/workflows/scorecard-enforcer.yml b/actions/validate/.github/workflows/scorecard-enforcer.yml index bbba795..57bcadd 100644 --- a/actions/validate/.github/workflows/scorecard-enforcer.yml +++ b/actions/validate/.github/workflows/scorecard-enforcer.yml @@ -14,4 +14,7 @@ permissions: jobs: scorecard: - uses: ../../../.github/workflows/scorecard-reusable.yml + permissions: + contents: read + security-events: write + uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@4e6ffe5568d7864f540d99c7d4ea9b9250ed30f2 diff --git a/actions/validate/.github/workflows/scorecard.yml b/actions/validate/.github/workflows/scorecard.yml index d665a83..31924ff 100644 --- a/actions/validate/.github/workflows/scorecard.yml +++ b/actions/validate/.github/workflows/scorecard.yml @@ -20,5 +20,8 @@ permissions: jobs: scorecard: - uses: ../../../.github/workflows/scorecard-reusable.yml + permissions: + contents: read + security-events: write + uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@4e6ffe5568d7864f540d99c7d4ea9b9250ed30f2 secrets: inherit diff --git a/actions/validate/.github/workflows/secret-scanner.yml b/actions/validate/.github/workflows/secret-scanner.yml index 82b3c70..682b409 100644 --- a/actions/validate/.github/workflows/secret-scanner.yml +++ b/actions/validate/.github/workflows/secret-scanner.yml @@ -17,5 +17,5 @@ jobs: scan: permissions: contents: read - uses: ../../../.github/workflows/secret-scanner-reusable.yml + uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@4e6ffe5568d7864f540d99c7d4ea9b9250ed30f2 secrets: inherit diff --git a/bindings/deno/.github/workflows/codeql.yml b/bindings/deno/.github/workflows/codeql.yml index de07c8f..e6bdb0e 100644 --- a/bindings/deno/.github/workflows/codeql.yml +++ b/bindings/deno/.github/workflows/codeql.yml @@ -18,6 +18,10 @@ permissions: jobs: analyze-js: - uses: ../../../.github/workflows/codeql-reusable.yml + permissions: + actions: read + contents: read + security-events: write + uses: hyperpolymath/standards/.github/workflows/codeql-reusable.yml@4e6ffe5568d7864f540d99c7d4ea9b9250ed30f2 with: language: javascript-typescript diff --git a/bindings/deno/.github/workflows/governance.yml b/bindings/deno/.github/workflows/governance.yml index f5f282c..bd68b4c 100644 --- a/bindings/deno/.github/workflows/governance.yml +++ b/bindings/deno/.github/workflows/governance.yml @@ -24,4 +24,7 @@ permissions: jobs: governance: - uses: ../../../.github/workflows/governance-reusable.yml + permissions: + actions: read + contents: read + uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@4e6ffe5568d7864f540d99c7d4ea9b9250ed30f2 diff --git a/bindings/deno/.github/workflows/hypatia-scan.yml b/bindings/deno/.github/workflows/hypatia-scan.yml index f120579..fbd8812 100644 --- a/bindings/deno/.github/workflows/hypatia-scan.yml +++ b/bindings/deno/.github/workflows/hypatia-scan.yml @@ -17,5 +17,9 @@ permissions: jobs: scan: - uses: ../../../.github/workflows/hypatia-scan-reusable.yml + permissions: + actions: read + contents: read + security-events: write + uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@4e6ffe5568d7864f540d99c7d4ea9b9250ed30f2 secrets: inherit diff --git a/bindings/deno/.github/workflows/mirror.yml b/bindings/deno/.github/workflows/mirror.yml index a20ae7d..639988a 100644 --- a/bindings/deno/.github/workflows/mirror.yml +++ b/bindings/deno/.github/workflows/mirror.yml @@ -11,5 +11,8 @@ permissions: jobs: mirror: - uses: ../../../.github/workflows/mirror-reusable.yml + permissions: + actions: read + contents: read + uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@4e6ffe5568d7864f540d99c7d4ea9b9250ed30f2 secrets: inherit diff --git a/bindings/deno/.github/workflows/scorecard-enforcer.yml b/bindings/deno/.github/workflows/scorecard-enforcer.yml index bbba795..57bcadd 100644 --- a/bindings/deno/.github/workflows/scorecard-enforcer.yml +++ b/bindings/deno/.github/workflows/scorecard-enforcer.yml @@ -14,4 +14,7 @@ permissions: jobs: scorecard: - uses: ../../../.github/workflows/scorecard-reusable.yml + permissions: + contents: read + security-events: write + uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@4e6ffe5568d7864f540d99c7d4ea9b9250ed30f2 diff --git a/bindings/deno/.github/workflows/scorecard.yml b/bindings/deno/.github/workflows/scorecard.yml index d665a83..31924ff 100644 --- a/bindings/deno/.github/workflows/scorecard.yml +++ b/bindings/deno/.github/workflows/scorecard.yml @@ -20,5 +20,8 @@ permissions: jobs: scorecard: - uses: ../../../.github/workflows/scorecard-reusable.yml + permissions: + contents: read + security-events: write + uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@4e6ffe5568d7864f540d99c7d4ea9b9250ed30f2 secrets: inherit diff --git a/bindings/deno/.github/workflows/secret-scanner.yml b/bindings/deno/.github/workflows/secret-scanner.yml index 82b3c70..682b409 100644 --- a/bindings/deno/.github/workflows/secret-scanner.yml +++ b/bindings/deno/.github/workflows/secret-scanner.yml @@ -17,5 +17,5 @@ jobs: scan: permissions: contents: read - uses: ../../../.github/workflows/secret-scanner-reusable.yml + uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@4e6ffe5568d7864f540d99c7d4ea9b9250ed30f2 secrets: inherit diff --git a/bindings/haskell/.github/workflows/codeql.yml b/bindings/haskell/.github/workflows/codeql.yml index de07c8f..e6bdb0e 100644 --- a/bindings/haskell/.github/workflows/codeql.yml +++ b/bindings/haskell/.github/workflows/codeql.yml @@ -18,6 +18,10 @@ permissions: jobs: analyze-js: - uses: ../../../.github/workflows/codeql-reusable.yml + permissions: + actions: read + contents: read + security-events: write + uses: hyperpolymath/standards/.github/workflows/codeql-reusable.yml@4e6ffe5568d7864f540d99c7d4ea9b9250ed30f2 with: language: javascript-typescript diff --git a/bindings/haskell/.github/workflows/governance.yml b/bindings/haskell/.github/workflows/governance.yml index f5f282c..bd68b4c 100644 --- a/bindings/haskell/.github/workflows/governance.yml +++ b/bindings/haskell/.github/workflows/governance.yml @@ -24,4 +24,7 @@ permissions: jobs: governance: - uses: ../../../.github/workflows/governance-reusable.yml + permissions: + actions: read + contents: read + uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@4e6ffe5568d7864f540d99c7d4ea9b9250ed30f2 diff --git a/bindings/haskell/.github/workflows/hypatia-scan.yml b/bindings/haskell/.github/workflows/hypatia-scan.yml index f120579..fbd8812 100644 --- a/bindings/haskell/.github/workflows/hypatia-scan.yml +++ b/bindings/haskell/.github/workflows/hypatia-scan.yml @@ -17,5 +17,9 @@ permissions: jobs: scan: - uses: ../../../.github/workflows/hypatia-scan-reusable.yml + permissions: + actions: read + contents: read + security-events: write + uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@4e6ffe5568d7864f540d99c7d4ea9b9250ed30f2 secrets: inherit diff --git a/bindings/haskell/.github/workflows/mirror.yml b/bindings/haskell/.github/workflows/mirror.yml index a20ae7d..639988a 100644 --- a/bindings/haskell/.github/workflows/mirror.yml +++ b/bindings/haskell/.github/workflows/mirror.yml @@ -11,5 +11,8 @@ permissions: jobs: mirror: - uses: ../../../.github/workflows/mirror-reusable.yml + permissions: + actions: read + contents: read + uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@4e6ffe5568d7864f540d99c7d4ea9b9250ed30f2 secrets: inherit diff --git a/bindings/haskell/.github/workflows/scorecard-enforcer.yml b/bindings/haskell/.github/workflows/scorecard-enforcer.yml index bbba795..57bcadd 100644 --- a/bindings/haskell/.github/workflows/scorecard-enforcer.yml +++ b/bindings/haskell/.github/workflows/scorecard-enforcer.yml @@ -14,4 +14,7 @@ permissions: jobs: scorecard: - uses: ../../../.github/workflows/scorecard-reusable.yml + permissions: + contents: read + security-events: write + uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@4e6ffe5568d7864f540d99c7d4ea9b9250ed30f2 diff --git a/bindings/haskell/.github/workflows/scorecard.yml b/bindings/haskell/.github/workflows/scorecard.yml index d665a83..31924ff 100644 --- a/bindings/haskell/.github/workflows/scorecard.yml +++ b/bindings/haskell/.github/workflows/scorecard.yml @@ -20,5 +20,8 @@ permissions: jobs: scorecard: - uses: ../../../.github/workflows/scorecard-reusable.yml + permissions: + contents: read + security-events: write + uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@4e6ffe5568d7864f540d99c7d4ea9b9250ed30f2 secrets: inherit diff --git a/bindings/haskell/.github/workflows/secret-scanner.yml b/bindings/haskell/.github/workflows/secret-scanner.yml index 82b3c70..682b409 100644 --- a/bindings/haskell/.github/workflows/secret-scanner.yml +++ b/bindings/haskell/.github/workflows/secret-scanner.yml @@ -17,5 +17,5 @@ jobs: scan: permissions: contents: read - uses: ../../../.github/workflows/secret-scanner-reusable.yml + uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@4e6ffe5568d7864f540d99c7d4ea9b9250ed30f2 secrets: inherit diff --git a/bindings/rust/.github/workflows/codeql.yml b/bindings/rust/.github/workflows/codeql.yml index de07c8f..e6bdb0e 100644 --- a/bindings/rust/.github/workflows/codeql.yml +++ b/bindings/rust/.github/workflows/codeql.yml @@ -18,6 +18,10 @@ permissions: jobs: analyze-js: - uses: ../../../.github/workflows/codeql-reusable.yml + permissions: + actions: read + contents: read + security-events: write + uses: hyperpolymath/standards/.github/workflows/codeql-reusable.yml@4e6ffe5568d7864f540d99c7d4ea9b9250ed30f2 with: language: javascript-typescript diff --git a/bindings/rust/.github/workflows/governance.yml b/bindings/rust/.github/workflows/governance.yml index f5f282c..bd68b4c 100644 --- a/bindings/rust/.github/workflows/governance.yml +++ b/bindings/rust/.github/workflows/governance.yml @@ -24,4 +24,7 @@ permissions: jobs: governance: - uses: ../../../.github/workflows/governance-reusable.yml + permissions: + actions: read + contents: read + uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@4e6ffe5568d7864f540d99c7d4ea9b9250ed30f2 diff --git a/bindings/rust/.github/workflows/hypatia-scan.yml b/bindings/rust/.github/workflows/hypatia-scan.yml index f120579..fbd8812 100644 --- a/bindings/rust/.github/workflows/hypatia-scan.yml +++ b/bindings/rust/.github/workflows/hypatia-scan.yml @@ -17,5 +17,9 @@ permissions: jobs: scan: - uses: ../../../.github/workflows/hypatia-scan-reusable.yml + permissions: + actions: read + contents: read + security-events: write + uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@4e6ffe5568d7864f540d99c7d4ea9b9250ed30f2 secrets: inherit diff --git a/bindings/rust/.github/workflows/mirror.yml b/bindings/rust/.github/workflows/mirror.yml index a20ae7d..639988a 100644 --- a/bindings/rust/.github/workflows/mirror.yml +++ b/bindings/rust/.github/workflows/mirror.yml @@ -11,5 +11,8 @@ permissions: jobs: mirror: - uses: ../../../.github/workflows/mirror-reusable.yml + permissions: + actions: read + contents: read + uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@4e6ffe5568d7864f540d99c7d4ea9b9250ed30f2 secrets: inherit diff --git a/bindings/rust/.github/workflows/scorecard-enforcer.yml b/bindings/rust/.github/workflows/scorecard-enforcer.yml index bbba795..57bcadd 100644 --- a/bindings/rust/.github/workflows/scorecard-enforcer.yml +++ b/bindings/rust/.github/workflows/scorecard-enforcer.yml @@ -14,4 +14,7 @@ permissions: jobs: scorecard: - uses: ../../../.github/workflows/scorecard-reusable.yml + permissions: + contents: read + security-events: write + uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@4e6ffe5568d7864f540d99c7d4ea9b9250ed30f2 diff --git a/bindings/rust/.github/workflows/scorecard.yml b/bindings/rust/.github/workflows/scorecard.yml index d665a83..31924ff 100644 --- a/bindings/rust/.github/workflows/scorecard.yml +++ b/bindings/rust/.github/workflows/scorecard.yml @@ -20,5 +20,8 @@ permissions: jobs: scorecard: - uses: ../../../.github/workflows/scorecard-reusable.yml + permissions: + contents: read + security-events: write + uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@4e6ffe5568d7864f540d99c7d4ea9b9250ed30f2 secrets: inherit diff --git a/bindings/rust/.github/workflows/secret-scanner.yml b/bindings/rust/.github/workflows/secret-scanner.yml index 82b3c70..682b409 100644 --- a/bindings/rust/.github/workflows/secret-scanner.yml +++ b/bindings/rust/.github/workflows/secret-scanner.yml @@ -17,5 +17,5 @@ jobs: scan: permissions: contents: read - uses: ../../../.github/workflows/secret-scanner-reusable.yml + uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@4e6ffe5568d7864f540d99c7d4ea9b9250ed30f2 secrets: inherit diff --git a/editors/vscode/.github/workflows/codeql.yml b/editors/vscode/.github/workflows/codeql.yml index de07c8f..e6bdb0e 100644 --- a/editors/vscode/.github/workflows/codeql.yml +++ b/editors/vscode/.github/workflows/codeql.yml @@ -18,6 +18,10 @@ permissions: jobs: analyze-js: - uses: ../../../.github/workflows/codeql-reusable.yml + permissions: + actions: read + contents: read + security-events: write + uses: hyperpolymath/standards/.github/workflows/codeql-reusable.yml@4e6ffe5568d7864f540d99c7d4ea9b9250ed30f2 with: language: javascript-typescript diff --git a/editors/vscode/.github/workflows/governance.yml b/editors/vscode/.github/workflows/governance.yml index f5f282c..bd68b4c 100644 --- a/editors/vscode/.github/workflows/governance.yml +++ b/editors/vscode/.github/workflows/governance.yml @@ -24,4 +24,7 @@ permissions: jobs: governance: - uses: ../../../.github/workflows/governance-reusable.yml + permissions: + actions: read + contents: read + uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@4e6ffe5568d7864f540d99c7d4ea9b9250ed30f2 diff --git a/editors/vscode/.github/workflows/hypatia-scan.yml b/editors/vscode/.github/workflows/hypatia-scan.yml index f120579..fbd8812 100644 --- a/editors/vscode/.github/workflows/hypatia-scan.yml +++ b/editors/vscode/.github/workflows/hypatia-scan.yml @@ -17,5 +17,9 @@ permissions: jobs: scan: - uses: ../../../.github/workflows/hypatia-scan-reusable.yml + permissions: + actions: read + contents: read + security-events: write + uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@4e6ffe5568d7864f540d99c7d4ea9b9250ed30f2 secrets: inherit diff --git a/editors/vscode/.github/workflows/mirror.yml b/editors/vscode/.github/workflows/mirror.yml index a20ae7d..639988a 100644 --- a/editors/vscode/.github/workflows/mirror.yml +++ b/editors/vscode/.github/workflows/mirror.yml @@ -11,5 +11,8 @@ permissions: jobs: mirror: - uses: ../../../.github/workflows/mirror-reusable.yml + permissions: + actions: read + contents: read + uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@4e6ffe5568d7864f540d99c7d4ea9b9250ed30f2 secrets: inherit diff --git a/editors/vscode/.github/workflows/scorecard-enforcer.yml b/editors/vscode/.github/workflows/scorecard-enforcer.yml index bbba795..57bcadd 100644 --- a/editors/vscode/.github/workflows/scorecard-enforcer.yml +++ b/editors/vscode/.github/workflows/scorecard-enforcer.yml @@ -14,4 +14,7 @@ permissions: jobs: scorecard: - uses: ../../../.github/workflows/scorecard-reusable.yml + permissions: + contents: read + security-events: write + uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@4e6ffe5568d7864f540d99c7d4ea9b9250ed30f2 diff --git a/editors/vscode/.github/workflows/scorecard.yml b/editors/vscode/.github/workflows/scorecard.yml index d665a83..31924ff 100644 --- a/editors/vscode/.github/workflows/scorecard.yml +++ b/editors/vscode/.github/workflows/scorecard.yml @@ -20,5 +20,8 @@ permissions: jobs: scorecard: - uses: ../../../.github/workflows/scorecard-reusable.yml + permissions: + contents: read + security-events: write + uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@4e6ffe5568d7864f540d99c7d4ea9b9250ed30f2 secrets: inherit diff --git a/editors/vscode/.github/workflows/secret-scanner.yml b/editors/vscode/.github/workflows/secret-scanner.yml index 82b3c70..682b409 100644 --- a/editors/vscode/.github/workflows/secret-scanner.yml +++ b/editors/vscode/.github/workflows/secret-scanner.yml @@ -17,5 +17,5 @@ jobs: scan: permissions: contents: read - uses: ../../../.github/workflows/secret-scanner-reusable.yml + uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@4e6ffe5568d7864f540d99c7d4ea9b9250ed30f2 secrets: inherit diff --git a/pandoc/.github/workflows/codeql.yml b/pandoc/.github/workflows/codeql.yml index de07c8f..e6bdb0e 100644 --- a/pandoc/.github/workflows/codeql.yml +++ b/pandoc/.github/workflows/codeql.yml @@ -18,6 +18,10 @@ permissions: jobs: analyze-js: - uses: ../../../.github/workflows/codeql-reusable.yml + permissions: + actions: read + contents: read + security-events: write + uses: hyperpolymath/standards/.github/workflows/codeql-reusable.yml@4e6ffe5568d7864f540d99c7d4ea9b9250ed30f2 with: language: javascript-typescript diff --git a/pandoc/.github/workflows/governance.yml b/pandoc/.github/workflows/governance.yml index f5f282c..bd68b4c 100644 --- a/pandoc/.github/workflows/governance.yml +++ b/pandoc/.github/workflows/governance.yml @@ -24,4 +24,7 @@ permissions: jobs: governance: - uses: ../../../.github/workflows/governance-reusable.yml + permissions: + actions: read + contents: read + uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@4e6ffe5568d7864f540d99c7d4ea9b9250ed30f2 diff --git a/pandoc/.github/workflows/hypatia-scan.yml b/pandoc/.github/workflows/hypatia-scan.yml index f120579..fbd8812 100644 --- a/pandoc/.github/workflows/hypatia-scan.yml +++ b/pandoc/.github/workflows/hypatia-scan.yml @@ -17,5 +17,9 @@ permissions: jobs: scan: - uses: ../../../.github/workflows/hypatia-scan-reusable.yml + permissions: + actions: read + contents: read + security-events: write + uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@4e6ffe5568d7864f540d99c7d4ea9b9250ed30f2 secrets: inherit diff --git a/pandoc/.github/workflows/mirror.yml b/pandoc/.github/workflows/mirror.yml index a20ae7d..639988a 100644 --- a/pandoc/.github/workflows/mirror.yml +++ b/pandoc/.github/workflows/mirror.yml @@ -11,5 +11,8 @@ permissions: jobs: mirror: - uses: ../../../.github/workflows/mirror-reusable.yml + permissions: + actions: read + contents: read + uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@4e6ffe5568d7864f540d99c7d4ea9b9250ed30f2 secrets: inherit diff --git a/pandoc/.github/workflows/scorecard-enforcer.yml b/pandoc/.github/workflows/scorecard-enforcer.yml index bbba795..57bcadd 100644 --- a/pandoc/.github/workflows/scorecard-enforcer.yml +++ b/pandoc/.github/workflows/scorecard-enforcer.yml @@ -14,4 +14,7 @@ permissions: jobs: scorecard: - uses: ../../../.github/workflows/scorecard-reusable.yml + permissions: + contents: read + security-events: write + uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@4e6ffe5568d7864f540d99c7d4ea9b9250ed30f2 diff --git a/pandoc/.github/workflows/scorecard.yml b/pandoc/.github/workflows/scorecard.yml index d665a83..31924ff 100644 --- a/pandoc/.github/workflows/scorecard.yml +++ b/pandoc/.github/workflows/scorecard.yml @@ -20,5 +20,8 @@ permissions: jobs: scorecard: - uses: ../../../.github/workflows/scorecard-reusable.yml + permissions: + contents: read + security-events: write + uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@4e6ffe5568d7864f540d99c7d4ea9b9250ed30f2 secrets: inherit diff --git a/pandoc/.github/workflows/secret-scanner.yml b/pandoc/.github/workflows/secret-scanner.yml index 82b3c70..682b409 100644 --- a/pandoc/.github/workflows/secret-scanner.yml +++ b/pandoc/.github/workflows/secret-scanner.yml @@ -17,5 +17,5 @@ jobs: scan: permissions: contents: read - uses: ../../../.github/workflows/secret-scanner-reusable.yml + uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@4e6ffe5568d7864f540d99c7d4ea9b9250ed30f2 secrets: inherit