From cbce6a685fdc5da4308d2e410639fb1d687fd34b Mon Sep 17 00:00:00 2001 From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com> Date: Thu, 5 Nov 2026 23:48:38 -0500 Subject: [PATCH 1/2] ci(intake): grant intake-triage's caller job actions: read The ci-workflows intake-triage reusable reads this repository's credit-stop markers before it spends a key, which needs actions: read (standards#949 contract, accepted alongside the old map by standards#950). Refs: #13586 Co-Authored-By: Claude Opus 5.5 --- .github/workflows/intake-triage.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/intake-triage.yml b/.github/workflows/intake-triage.yml index b84dd72a442..44b547fdcd1 100644 --- a/.github/workflows/intake-triage.yml +++ b/.github/workflows/intake-triage.yml @@ -260,6 +260,7 @@ jobs: && (github.event_name == 'workflow_dispatch' || needs.born-triaged.outputs.skip != 'true') && needs.born-triaged.outputs.claude-args != '' }} permissions: + actions: read # list this repository's credit-stop markers contents: read # check out the default branch so the lane can read AGENTS.md issues: write # apply labels and post the triage comment concurrency: From 7ced3c78a74f6abc37605c38228df681cf34d793 Mon Sep 17 00:00:00 2001 From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com> Date: Fri, 6 Nov 2026 00:32:00 -0500 Subject: [PATCH 2/2] test(intake): pin the intake-triage caller job's actions: read Co-Authored-By: Claude Opus 5.5 --- .github/actions/resolve-config/callers.test.mjs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/actions/resolve-config/callers.test.mjs b/.github/actions/resolve-config/callers.test.mjs index 70363fe5ca5..b31178bed2a 100644 --- a/.github/actions/resolve-config/callers.test.mjs +++ b/.github/actions/resolve-config/callers.test.mjs @@ -396,7 +396,7 @@ test("intake-triage.yml: each job keeps its own least-privilege permissions", () "born-triaged": { contents: "read", issues: "read" }, "kill-switch": { contents: "read" }, "intake-label-needs-triage": { issues: "write" }, - "intake-triage": { contents: "read", issues: "write" }, + "intake-triage": { actions: "read", contents: "read", issues: "write" }, "apply-verdict": { contents: "read", "id-token": "write" }, "refine-select": { contents: "read", issues: "read", "pull-requests": "read" }, "refine-key-credit": { actions: "read" },