chore: R-16 toolchain pin + reconciliation #105
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -11,8 +11,4 @@ permissions: | |
|
|
||
| jobs: | ||
| scorecard: | ||
| uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@d7c22711e830e1f383846472f6e9b99debdb201e | ||
|
There was a problem hiding this comment. 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win 🔎 Supported by static analysis🏁 Script executed: #!/usr/bin/env bash
set -euo pipefail
file=".github/workflows/scorecard.yml"
rg -n '(^permissions:|^[[:space:]]+permissions:|security-events:|id-token:)' "$file"
rg -q 'security-events:[[:space:]]*write' "$file" || {
echo "Missing security-events: write in the caller"
exit 1
}
rg -q 'id-token:[[:space:]]*write' "$file" || {
echo "Missing id-token: write in the caller"
exit 1
}Repository: hyperpolymath/iseriser Length of output: 220 🏁 Script executed: #!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- repository conventions ---'
find /tmp/coderabbit-repo-knowledge/hyperpolymath-iseriser-880ad2fd -type f -path '*/\*.md' -maxdepth 3 -print \
| sort
printf '%s\n' '--- workflow ---'
cat -n .github/workflows/scorecard.yml
printf '%s\n' '--- relevant diff ---'
git diff -- .github/workflows/scorecard.ymlRepository: hyperpolymath/iseriser Length of output: 612 🏁 Script executed: #!/usr/bin/env bash
set -euo pipefail
url='https://raw.githubusercontent.com/hyperpolymath/standards/d7c22711e830e1f383846472f6e9b99debdb201e/.github/workflows/scorecard-reusable.yml'
curl --fail --silent --show-error "$url" | nl -ba | sed -n '1,220p'Repository: hyperpolymath/iseriser Length of output: 226 🏁 Script executed: #!/usr/bin/env bash
set -euo pipefail
url='https://raw.githubusercontent.com/hyperpolymath/standards/d7c22711e830e1f383846472f6e9b99debdb201e/.github/workflows/scorecard-reusable.yml'
curl --fail --silent --show-error "$url" | sed -n '1,220p'Repository: hyperpolymath/iseriser Length of output: 1068 🌐 Web query:
💡 Result: In GitHub Actions, it is a fundamental security constraint that a reusable (called) workflow cannot elevate the GITHUB_TOKEN permissions beyond what the calling workflow has explicitly granted [1][2][3]. The effective permissions of a called workflow are defined by the intersection of the permissions granted by the caller and the permissions requested by the callee [4][5][6]. If a called workflow requires specific scopes—such as security-events: write or id-token: write for tools like OSSF Scorecard—these permissions must be explicitly declared within the calling workflow's job [1][6][7]. If the caller does not grant these permissions, the workflow run will fail at the startup/planning phase with an error, often citing that the workflow is requesting a permission but is only allowed a lesser scope [6][7]. To resolve or prevent these issues, follow these practices: 1. Caller Configuration: Explicitly grant the required permissions in the calling job [1][7]. Do not rely on default permissions, as they are often too restrictive for write-heavy tasks [5][2][6]. jobs: scorecard-job: permissions: security-events: write id-token: write contents: read uses:.github/workflows/scorecard.yml 2. Callee Configuration: The reusable workflow should also declare its required permissions [6]. This ensures the "intersection" rule is satisfied predictably and provides clarity [5][6]. 3. Troubleshooting Startup Failures: If a workflow fails with an opaque "startup_failure" or a permission-related error before any job steps run, check the calling job's permissions block [1][7]. A called workflow cannot "widen" its own token, so the caller must act as the source of authority for these elevated privileges [6][8]. Regarding OSSF Scorecard specifically, publish_results: true requires id-token: write to access the OIDC token for authenticity verification [9][10][11]. Uploading results to the security tab requires security-events: write [9][11]. These must be granted at the job level in the calling workflow [9][11]. Citations:
Restore the caller permissions required by Scorecard.
</verification_static_supported> 🤖 Prompt for AI AgentsSource: MCP tools |
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,10 @@ | ||
| [tools] | ||
| # = "Uncomment and customize for your project" | ||
| # = "rust nightly" | ||
| # = "just 1.40.0" | ||
| # = "nickel 1.10.0" | ||
| # = "gleam 1.8.0" | ||
| # = "elixir 1.18.0" | ||
| # = "erlang 27.2" | ||
| # = "zig 0.14.0" | ||
| # = "idris2 0.7.0" |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🩺 Stability & Availability | 🔴 Critical | ⚡ Quick win
🔎 Supported by static analysis
🏁 Script executed:
Repository: hyperpolymath/iseriser
Length of output: 1107
🏁 Script executed:
Repository: hyperpolymath/iseriser
Length of output: 12032
Use a reusable workflow revision that supplies the Rust toolchain input.
The pinned
dtolnay/rust-toolchainaction requirestoolchain. The new reusable workflow omits this input in several jobs, so this repository's Rust CI can fail before checks run.🤖 Prompt for AI Agents
Source: MCP tools