From ca81f40e32357bfc4b10e6fc41b8431d84b7a345 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Thu, 6 Aug 2026 04:15:11 +0100 Subject: [PATCH] =?UTF-8?q?fix(ci):=20remove=20a=20duplicated=20permission?= =?UTF-8?q?s=20block=20=E2=80=94=20ci.yml=20has=20never=20parsed?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The `security-codeql` job declared `permissions:` twice: permissions: contents: read permissions: security-events: write actions: read contents: read GitHub Actions rejects a workflow with duplicate keys outright — the run is `failure` with no jobs, no log and no check run. This file has never executed. The FIRST block is removed rather than the second, because the second is a strict superset: it already grants `contents: read` alongside the two permissions CodeQL actually needs to upload results. Keeping the first would have left the job unable to write security events, so the choice is not arbitrary — it is the only one that preserves what the job is for. Verified: every workflow in the repository parses after the change, and the surviving declaration is {security-events: write, actions: read, contents: read}. Part of an estate-wide repair: 67 repositories and 100 workflow files were left unparseable by sweeps that edited by line position rather than by parsing. Detection is being added upstream (hyperpolymath/standards#582) — ordinary validation cannot see this, because yaml.safe_load silently keeps the last duplicate and reports success. Co-Authored-By: Claude Fable 5 Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com> --- .github/workflows/ci.yml | 2 -- 1 file changed, 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 8b8821a..7bc9cca 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -523,8 +523,6 @@ jobs: name: CodeQL Analysis runs-on: ubuntu-latest timeout-minutes: 15 - permissions: - contents: read permissions: security-events: write actions: read