From 2c0e52c0d4cb9a2269eb0464d9fedf20d3202cd4 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Thu, 6 Aug 2026 04:18:46 +0100 Subject: [PATCH] =?UTF-8?q?fix(ci):=20deduplicate=20the=20permissions=20ma?= =?UTF-8?q?pping=20=E2=80=94=20hypatia-scan.yml=20has=20never=20run?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The top-level `permissions:` block declared the same key twice: security-events: read security-events: write GitHub Actions rejects a workflow with duplicate keys outright, so this file has never executed: `failure`, no jobs, no log, no check run. `write` is kept, and the choice is not arbitrary. hypatia-scan calls a reusable workflow that declares `security-events: write`, and GitHub refuses to start a reusable call whose caller grants LESS than the reusable declares — the failure mode being startup_failure, with no log. Keeping `read` would have produced a file that parses and a job that still cannot run. The rule applied is: keep the widest value for each key (write > read > none). That is the only choice which cannot break a job that already depended on the capability. Part of an estate-wide repair — 67 repositories, 100 workflow files left unparseable by sweeps that edited by line position rather than by parsing. Detection is being added upstream (hyperpolymath/standards#582): ordinary validation cannot see this, because yaml.safe_load silently keeps the last duplicate and reports success. Co-Authored-By: Claude Fable 5 Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com> --- .github/workflows/hypatia-scan.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index fe3cfe5..f0cd843 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -14,7 +14,6 @@ on: permissions: actions: read contents: read - security-events: read security-events: write jobs: