From 7add7bcac05ea4cb2fc0af62ec106dcd4779d73e Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Tue, 21 Jul 2026 15:46:19 +0100
Subject: [PATCH] fix(ci): grant scorecard's called workflow contents:read;
 revert unproven checkout bump

Two independent CI fixes, both measured on main after #293.

1. `Scorecards supply-chain security` -- the last startup_failure

Re-pinning scorecard-reusable in #293 did NOT fix it, which proves the
pin was never the cause. Root cause is the caller's permission block:

    jobs:
      analysis:
        permissions:
          security-events: write
          id-token: write        # <- contents omitted

Declaring `permissions:` at job level sets every UNLISTED scope to
`none`, and a called workflow can never hold more than the calling job
grants it. scorecard-reusable declares top-level `permissions: contents:
read` and its first step is actions/checkout, so it was being handed
`contents: none` -- the call died at startup with zero jobs, which is why
there is no log to read.

Confirmed against the green sibling: boj-server-cartridges' scorecard.yml
lists all three (`contents: read`, `security-events: write`,
`id-token: write`) and its runs succeed. Adding `contents: read` here.

This is root cause (A) from the estate's two startup_failure shapes --
reusable permission escalation -- not BROKEN-M1.

2. Revert pages.yml/pages-deploy.yml checkout to the v4 SHA

#293 pinned these to de0fac2e (v6.0.2). Both workflows are
`push: [main]`-only, so no PR could exercise them, and pages.yml is this
repo's only container job (idris2-pack) and has never completed a run --
checkout v6 needs node24 injected into the container, which is precisely
what could not be observed. 11d5960a is exactly what `actions/checkout@v4`
resolves to today, so this is a pure pin: the linter only requires a
full-length SHA, not a particular version. A considered v4 -> v6 bump
belongs in a change where it can be watched.

Verified: 0 of 94 `uses:` unpinned; all three files parse as YAML.
---
 .github/workflows/pages-deploy.yml | 2 +-
 .github/workflows/pages.yml        | 4 ++--
 .github/workflows/scorecard.yml    | 8 ++++++++
 3 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/pages-deploy.yml b/.github/workflows/pages-deploy.yml
index aa7b56da..6679fbb0 100644
--- a/.github/workflows/pages-deploy.yml
+++ b/.github/workflows/pages-deploy.yml
@@ -18,7 +18,7 @@ jobs:
   deploy:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       - name: Deploy site/ to Cloudflare Workers (static assets)
         run: npx wrangler@latest deploy
         env:
diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml
index 006ab206..1b09c482 100755
--- a/.github/workflows/pages.yml
+++ b/.github/workflows/pages.yml
@@ -23,9 +23,9 @@ jobs:
       image: ghcr.io/stefan-hoeck/idris2-pack@sha256:f0758996a931fb35d9ecb1de273c4d59dabe2a09b433afc7e357f65a08b7e1ff
     steps:
       - name: Checkout Site
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       - name: Checkout Ddraig SSG
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           repository: hyperpolymath/ddraig-ssg
           path: .ddraig-ssg
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 0eab2e6f..e5df9dc6 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -31,6 +31,14 @@ permissions:
 jobs:
   analysis:
     permissions:
+      # `contents: read` is REQUIRED, not redundant. Declaring `permissions:`
+      # at job level sets every unlisted scope to `none`, and a called
+      # workflow can never hold more than the calling job grants it. The
+      # reusable declares top-level `permissions: contents: read` and its
+      # first step is actions/checkout, so omitting `contents` here handed
+      # it `contents: none` and the call died at startup with zero jobs.
+      # The green sibling (boj-server-cartridges) lists all three.
+      contents: read
       security-events: write
       id-token: write
     uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@8813ecf2a841335c9dc14c75cc46694722cd6d28