From 28ded2ccc5e52b80d196d2cdb437e657c9fc4828 Mon Sep 17 00:00:00 2001 From: Cody Kickertz Date: Thu, 3 Sep 2026 09:12:05 -0500 Subject: [PATCH] ci(codeql): grant actions: read in the reusable CodeQL workflow MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit codeql-action/analyze fingerprints SARIF via GET /actions/runs/{id}, which requires actions: read. Public-repo callers stay green without it (the read falls back to public visibility), but any private-repo caller 403s at the fingerprint step and the job ends "configuration error" — observed on forkwright/arche run 33689539168 and forkwright/hestia run 33640480803 with standalone copies of this shape. Granting it here makes the template correct for private repos the day Advanced Security is purchased, and removes a silent reliance on public-data fallback for the public ones. Refs kanon#3644. --- .github/workflows/codeql.yml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 85d6271..d53e30b 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -43,6 +43,10 @@ jobs: permissions: security-events: write contents: read + # WHY: analyze fingerprints SARIF via the Actions workflow-run API, which + # 403s on private repos without this grant (public repos silently fall + # back to public visibility — the failure only surfaces on private ones). + actions: read steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: @@ -64,6 +68,10 @@ jobs: permissions: security-events: write contents: read + # WHY: analyze fingerprints SARIF via the Actions workflow-run API, which + # 403s on private repos without this grant (public repos silently fall + # back to public visibility — the failure only surfaces on private ones). + actions: read steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: