From 34fcbc51f04e6463189cd6016bd57e52f8ee9611 Mon Sep 17 00:00:00 2001 From: Claude Date: Sat, 11 Jul 2026 03:38:54 +0000 Subject: [PATCH] fix(strix): align scan job status permission with tightened smoke contract MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit PR #438 tightened strix_required_workflow_smoke.sh to require statuses: read on exactly the strix scan job and to forbid statuses: write anywhere, but left the scan job granting statuses: write (reintroduced by #428). Since the required-workflow smoke test validates the trusted source's HEAD, every Strix run org-wide fails with "Strix workflow must scope statuses: read only to the strix scan job; found: none" as of #438's merge (03:30 UTC) — confirmed by kaefa#65 passing at 03:24 and failing at 03:33 with no relevant change in between. Flip the scan job to statuses: read. This is functionally safe: every post_strix_status caller publishes via exchanged app/secret tokens (target-app, pr-review-merge, opencode-approve) with no GITHUB_TOKEN fallback, matching the workflow's own line-102 comment that GITHUB_TOKEN reads status evidence but must not write it. Verified: scripts/ci/strix_required_workflow_smoke.sh passes locally against this tree. Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01AMkMUa1c1RRsbHEfsQUhui --- .github/workflows/strix.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/strix.yml b/.github/workflows/strix.yml index 8ffcdc750..2385b8f8d 100644 --- a/.github/workflows/strix.yml +++ b/.github/workflows/strix.yml @@ -124,14 +124,14 @@ jobs: timeout-minutes: 45 runs-on: ubuntu-latest # Least-privilege token scoped to this job (Scorecard alert #43): the scan - # exchanges an OIDC token (id-token) and keeps commit status writes scoped - # to this scan job; publication still prefers exchanged app/secret tokens below. + # exchanges an OIDC token (id-token) and keeps GITHUB_TOKEN read-only for + # commit statuses; status publication uses exchanged app/secret tokens below. permissions: actions: read contents: read id-token: write models: read - statuses: write + statuses: read env: FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true steps: