From 2084d4d9039b950339432ad74fd3e0416bbb2b0a Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Mon, 21 Sep 2026 00:05:28 +0000
Subject: [PATCH] fix(ci): grant the wrapper the permissions the reusable
 declares
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The Hypatia reusable workflow declares `actions: read`, `contents: read` and
`security-events: write`. A caller job that does not grant at least what the
called workflow declares cannot start at all: every run of this wrapper was
`startup_failure`, so the repository published no Hypatia check — the defect
class of hyperpolymath/tropical-types#17 (a gate that names a context with no
publisher).

* grant `actions: read`
* pass `secrets: inherit` (the reusable consumes
  `secrets.HYPATIA_SCAN_PAT || secrets.GITHUB_TOKEN`)

No other change: the caller id, the pin, and the job body are untouched.
---
 .github/workflows/hypatia-scan.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml
index 2f545b7..683a328 100644
--- a/.github/workflows/hypatia-scan.yml
+++ b/.github/workflows/hypatia-scan.yml
@@ -20,9 +20,12 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 permissions:
+  actions: read
   contents: read
   security-events: write
 
 jobs:
   hypatia:
     uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@571cc734cd69fb846032ec77a662aa8ee4fc32cd
+
+    secrets: inherit
\ No newline at end of file