fix(ci): repair workflows that are not valid YAML and have never run

[hyperpolymath]

These workflow files are not valid YAML, so they have never run. Not "ran and failed" — never ran. GitHub Actions rejects the file before creating any job: the run is recorded as failure with no jobs, no log and no check run, and gh pr checks shows no row at all. A red mark with nothing behind it to read.

Cause

A sweep added permission declarations by line position rather than by parsing the document. Three invalid shapes resulted:

A — a mapping indented under a scalar value

permissions: read-all
  actions: read        # read-all is a SCALAR; it cannot take children

read-all already grants everything actions: read would, so the orphaned line is dropped and nothing is lost.

B — injected inside another block

on:
  permissions: contents: read     # two colons, and illegal under `on:` anyway
  push:

C — a literal \n that was never interpreted, gluing the escape's n to the key:

    runs-on: ubuntu-latest
npermissions:                     # "\npermissions:" written literally

Only a text-level writer emitting an uninterpreted escape can produce that.

Verified, not assumed

Every workflow in this repository parses after the change. The repairer refuses to write any file that does not parse and still contain jobs afterwards.

Where a job-level permissions: line was removed, a read-only top-level permissions: remains, so nothing is widened — and if none would remain, the tool reports that rather than inventing one. Guessing a permission set is how you silently over-grant.

Estate context

67 repositories and 100 workflow files are in this state. The most frequently broken file is workflow-linter.yml, in 22 repositories — followed by scorecard.yml (20) and dogfood-gate.yml (13).

The workflow whose job is to lint workflows was itself unparseable, so it never ran, and never caught this or anything else. The check that would have found the damage was destroyed by the same sweep that caused it.

So it cannot recur invisibly

Detection is being added upstream: a strict-YAML check in the governance reusable — hyperpolymath/standards#582. Ordinary validation cannot see this class of fault, because yaml.safe_load silently accepts duplicate keys and only a full parse catches the malformed indentation.

Expect this repository to get louder

Workflows that have been failing silently will now actually run, and some will find real problems that have been invisible for as long as the files have been broken.

🤖 Generated with Claude Code

[gitar-bot]

Note

Automatic reviews are paused because your trial's included automatic processing has been used for this period. Upgrade now, or comment "Gitar review" to run a review anytime.
Learn more

Code Review ✅ Approved

Removes duplicated permissions blocks and fixes indentation errors to restore valid YAML parsing in CI workflow files. No issues found.

Auto-approved and auto-merge armed: No blocking issues found.
Please see Auto-approve Docs for details on setting custom approval criteria. — merges when pipeline and required approvals pass.

Options

Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Compact

gitar display:verbose

---

Important

Your trial ends in 4 days — upgrade now to keep code review, CI analysis, auto-apply, custom automations, and more.

_{Was this helpful? React with 👍 / 👎 | Gitar}

[gitar-bot]

Gitar has auto-approved this PR and enabled auto-merge (configure)

[github-actions]

🔍 Hypatia Security Scan

Findings: 259 issues detected

Severity	Count
🔴 Critical	1
🟠 High	25
🟡 Medium	233

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Action actions/checkout@v4.1.7 needs attention",
    "type": "unpinned_action",
    "file": "boj-build.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action actions/checkout@v4.3.1 needs attention",
    "type": "unpinned_action",
    "file": "build.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action SonarSource/sonarqube-scan-action@v8.1.0 needs attention",
    "type": "unpinned_action",
    "file": "build.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action actions/checkout@v4.1.1 needs attention",
    "type": "unpinned_action",
    "file": "casket-pages.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action actions/checkout@v4.1.1 needs attention",
    "type": "unpinned_action",
    "file": "casket-pages.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action haskell-actions/setup@v2.7.5 needs attention",
    "type": "unpinned_action",
    "file": "casket-pages.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action actions/cache@v4.3.0 needs attention",
    "type": "unpinned_action",
    "file": "casket-pages.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action actions/configure-pages@v5.0.0 needs attention",
    "type": "unpinned_action",
    "file": "casket-pages.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action actions/upload-pages-artifact@v3.0.1 needs attention",
    "type": "unpinned_action",
    "file": "casket-pages.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action actions/deploy-pages@v4.0.5 needs attention",
    "type": "unpinned_action",
    "file": "casket-pages.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence