[hyperpolymath]

Summary

Adds the job-level permissions: { security-events: write, id-token: write } block to the analysis job in .github/workflows/scorecard.yml, fixing the silent startup_failure on every Scorecard run.

Why

scorecard-reusable.yml's docstring states:

Caller MUST grant security-events: write and id-token: write on the calling job. The reusable re-asserts these on its own analysis job, but called-workflow permissions are CAPPED by the caller's permissions block.

Without this, ossf/scorecard-action cannot upload SARIF, the workflow fails at startup, and there are no logs.

Sweep

Part of estate-wide sweep tracked at metadatastician/standards#282. Pattern shipped in julia-professional-registry#19 (2026-05-27) and absolute-zero#68 (2026-05-30).

Test plan

• Next Scorecard run completes successfully (cron '23 4 * * 1')
• SARIF appears in Security tab
• No startup_failure runs after merge

Refs metadatastician/standards#282

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

🔍 Hypatia Security Scan

Findings: 331 issues detected

Severity	Count
🔴 Critical	130
🟠 High	31
🟡 Medium	170

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Action perpolymath/standards/.github/workflows/governance-reusable.yml@main\n needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in architecture-enforcement.yml",
    "type": "missing_timeout_minutes",
    "file": "architecture-enforcement.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in architecture-enforcement.yml",
    "type": "missing_timeout_minutes",
    "file": "architecture-enforcement.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in boj-build.yml",
    "type": "missing_timeout_minutes",
    "file": "boj-build.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in casket-pages.yml",
    "type": "missing_timeout_minutes",
    "file": "casket-pages.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in casket-pages.yml",
    "type": "missing_timeout_minutes",
    "file": "casket-pages.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in cflite_batch.yml",
    "type": "missing_timeout_minutes",
    "file": "cflite_batch.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in cflite_pr.yml",
    "type": "missing_timeout_minutes",
    "file": "cflite_pr.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in codeql.yml",
    "type": "missing_timeout_minutes",
    "file": "codeql.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "missing_timeout_minutes",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence