From e4b799e248b97c770690e1c291b3b706d044768a Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Mon, 6 Jul 2026 22:46:49 +0100 Subject: [PATCH] fix(ci): make OSSF Scorecard caller valid (perms / drop timeout-minutes) Reusable scorecard caller failed at startup: needed security-events+id-token (reusable perms capped to caller grant) and/or an illegal timeout-minutes on the uses: job. Verified with actionlint. Pin preserved. --- .github/workflows/scorecard.yml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 08a434b..4ecc2ad 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -13,4 +13,8 @@ permissions: jobs: scorecard: - uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@d7c22711e830e1f383846472f6e9b99debdb201e \ No newline at end of file + uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@d7c22711e830e1f383846472f6e9b99debdb201e + permissions: + contents: read + security-events: write + id-token: write