From f5d656158a76af8eb176c5178619f7aef251c895 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Thu, 6 Aug 2026 04:03:24 +0100 Subject: [PATCH] fix(ci): repair workflows made unparseable by a blind permissions insertion MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit These workflow files are not valid YAML, so they have NEVER run. GitHub Actions rejects the file before creating any job: the run is recorded as `failure` with no jobs, no log and no check run, and `gh pr checks` shows no row at all. A red mark with nothing behind it to read. The cause is a sweep that added permission declarations by LINE POSITION rather than by parsing the document. Two invalid shapes resulted. permissions: read-all actions: read <- a mapping indented under a SCALAR value `read-all` is a scalar and cannot take children. It also already grants everything `actions: read` would, so the orphaned line is dropped and nothing is lost. on: permissions: contents: read <- two colons on one line, and push: `permissions` is not a valid key here Dropped entirely. VERIFIED, not assumed. Every workflow in this repository parses after the change, and the repairer refuses to write any file that does not parse and still contain jobs afterwards. Where a job-level permissions line was removed, a top-level `permissions:` remains and is read-only, so nothing is widened — and if none remained the tool reports that rather than inventing one, because guessing a permission set is how you silently over-grant. ESTATE CONTEXT: 67 repositories and 100 workflow files are in this state. The most frequently broken file is workflow-linter.yml, in 22 repositories — the workflow whose job is to lint workflows was itself unparseable, so it never ran and never caught this. Detection is being added upstream so it cannot recur invisibly: a strict YAML loader in the governance reusable (hyperpolymath/standards#582). Ordinary validation cannot see this class of fault, because yaml.safe_load accepts duplicate keys and only a full parse catches the malformed indentation. EXPECT THIS REPOSITORY TO GET LOUDER. Workflows that have been failing silently will now actually run, and some will find real problems. Co-Authored-By: Claude Fable 5 Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com> --- .github/workflows/aur-publish.yml | 1 - .github/workflows/codeql.yml | 1 - .github/workflows/container.yml | 1 - .github/workflows/generator-generic-ossf-slsa3-publish.yml | 1 - .github/workflows/language-policy.yml | 1 - .github/workflows/release.yml | 1 - 6 files changed, 6 deletions(-) diff --git a/.github/workflows/aur-publish.yml b/.github/workflows/aur-publish.yml index 5d38037..0ab886c 100644 --- a/.github/workflows/aur-publish.yml +++ b/.github/workflows/aur-publish.yml @@ -10,7 +10,6 @@ on: description: 'Version to publish (e.g., 1.0.0)' required: true permissions: read-all - actions: read jobs: publish-aur: name: Publish to AUR diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 6281ef5..2111eb8 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -18,7 +18,6 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true permissions: read-all - actions: read jobs: analyze: name: Analyze (${{ matrix.language }}) diff --git a/.github/workflows/container.yml b/.github/workflows/container.yml index 1ef2e9f..097be56 100644 --- a/.github/workflows/container.yml +++ b/.github/workflows/container.yml @@ -6,7 +6,6 @@ on: - 'v*' workflow_dispatch: permissions: read-all - actions: read env: REGISTRY: ghcr.io IMAGE_NAME: ${{ github.repository }} diff --git a/.github/workflows/generator-generic-ossf-slsa3-publish.yml b/.github/workflows/generator-generic-ossf-slsa3-publish.yml index 0ecee90..05d92af 100644 --- a/.github/workflows/generator-generic-ossf-slsa3-publish.yml +++ b/.github/workflows/generator-generic-ossf-slsa3-publish.yml @@ -17,7 +17,6 @@ on: release: types: [created] permissions: read-all - actions: read jobs: build: runs-on: ubuntu-latest diff --git a/.github/workflows/language-policy.yml b/.github/workflows/language-policy.yml index 3a73cf1..940e571 100644 --- a/.github/workflows/language-policy.yml +++ b/.github/workflows/language-policy.yml @@ -12,7 +12,6 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true permissions: read-all - actions: read jobs: check: runs-on: ubuntu-latest diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 0d56069..b0d0261 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -11,7 +11,6 @@ on: description: 'Release tag (e.g., v1.0.0)' required: true permissions: read-all - actions: read env: CARGO_TERM_COLOR: always RELEASE_TAG: ${{ github.event.inputs.tag || github.ref_name }}