fix(ci): apply foundation CI/CD security fixes (#267) #713
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # SPDX-License-Identifier: MPL-2.0 | ||
| # This workflow is managed by gh actions-lock. | ||
| # This workflow is managed by gh actions-lock. | ||
| # SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk> | ||
| name: Hypatia Security Scan | ||
| on: | ||
| push: | ||
| branches: [main, master, develop] | ||
| pull_request: | ||
| branches: [main, master] | ||
| schedule: | ||
| - cron: '0 0 * * 0' | ||
| workflow_dispatch: | ||
| permissions: | ||
| actions: read | ||
| contents: read | ||
| # Must be `write`, not `read`: hypatia-scan-reusable.yml declares | ||
| # `security-events: write` as of standards 45108f95e404, and GitHub refuses | ||
| # to start a reusable-workflow call whose caller grants less than the | ||
| # reusable declares (the failure mode is `startup_failure`, with no log). | ||
| security-events: write | ||
| jobs: | ||
| scan: | ||
| uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@cc58c0cb23f73fc2019ce85a56a468e5248a93b3 | ||
|
Check failure on line 27 in .github/workflows/hypatia-scan.yml
|
||