fix(ci): repair unparseable permissions scalar (1 workflow file(s))

[hyperpolymath]

permissions: read-all followed by an indented actions: read is a YAML
parse error. The workflow never starts, so it emits no check run — a
required context silently never reports, and this repository currently looks
greener than a repaired one.

read-all already grants actions: read, so removing the stray line is a
semantic no-op. Each file was verified with a real YAML parser: it fails
yq before the change and parses after it. Every diff is exactly one deleted line.

Files changed: workflow-linter.yml

Measured estate-wide: 42 such files across 28 repositories on main, all
carrying the identical stray key. Zero overlap with the TokenPermissions sweep.

🤖 Generated with Claude Code

https://claude.ai/code/session_0178nN4Nm3neFRy5K9StZKnB

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: d7c7ec80-4a8c-4c60-ab20-f7d7046b8881

📥 Commits

Reviewing files that changed from the base of the PR and between e754d2b and f89bc11.

📒 Files selected for processing (1)

• .github/workflows/workflow-linter.yml

💤 Files with no reviewable changes (1)

• .github/workflows/workflow-linter.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (6)

• GitHub Check: governance / Validate Hypatia Baseline
• GitHub Check: elixir-ci / Compile + test
• GitHub Check: governance / Security policy checks
• GitHub Check: analyze (javascript-typescript, none)
• GitHub Check: analyze (actions, none)
• GitHub Check: Build and test

⚠️ CI failures not shown inline (5)

GitHub Actions: Hypatia Security Scan / 0_Hypatia Neurosymbolic Analysis.txt: fix(ci): repair unparseable permissions scalar (1 workflow file(s))

Conclusion: failure

View job details

##[group]Running mix local.rebar,--force
 [command]/home/runner/work/_temp/.setup-beam/elixir/bin/mix local.rebar --force
 ** (Mix) httpc request failed with: {:failed_connect, [{:to_address, {~c"builds.hex.pm", 443}}, {:inet, [:inet], {:tls_alert, {:unsupported_certificate, ~c"TLS client: In state wait_cert_cr at ssl_handshake.erl:2199 generated CLIENT ALERT: Fatal - Unsupported Certificate\n {key_usage_mismatch,{{'Extension',{2,5,29,15},true,[keyCertSign,cRLSign]},\n                      {'Extension',{2,5,29,37},false,[{1,3,6,1,5,5,7,3,1}]}}}"}}}]}
 Could not install Rebar because Mix could not download metadata at https://builds.hex.pm/installs/rebar3-1.x.csv.
 Action mix rebar failed for mirror https://builds.hex.pm, with Error: The process '/home/runner/work/_temp/.setup-beam/elixir/bin/mix' failed with exit code 1
 ##[error]Could not mix rebar from any hex.pm mirror

---

GitHub Actions: Hypatia Security Scan / Hypatia Neurosymbolic Analysis: fix(ci): repair unparseable permissions scalar (1 workflow file(s))

Conclusion: failure

View job details

##[group]Running mix local.rebar,--force
 [command]/home/runner/work/_temp/.setup-beam/elixir/bin/mix local.rebar --force
 ** (Mix) httpc request failed with: {:failed_connect, [{:to_address, {~c"builds.hex.pm", 443}}, {:inet, [:inet], {:tls_alert, {:unsupported_certificate, ~c"TLS client: In state wait_cert_cr at ssl_handshake.erl:2199 generated CLIENT ALERT: Fatal - Unsupported Certificate\n {key_usage_mismatch,{{'Extension',{2,5,29,15},true,[keyCertSign,cRLSign]},\n                      {'Extension',{2,5,29,37},false,[{1,3,6,1,5,5,7,3,1}]}}}"}}}]}
 Could not install Rebar because Mix could not download metadata at https://builds.hex.pm/installs/rebar3-1.x.csv.
 Action mix rebar failed for mirror https://builds.hex.pm, with Error: The process '/home/runner/work/_temp/.setup-beam/elixir/bin/mix' failed with exit code 1
 ##[error]Could not mix rebar from any hex.pm mirror

---

GitHub Actions: Deno CI / 0_build.txt: fix(ci): repair unparseable permissions scalar (1 workflow file(s))

Conclusion: failure

View job details

##[group]Run deno task lint
 �[36;1mdeno task lint�[0m
 shell: /usr/bin/bash -e {0}
 ##[endgroup]
 �[0m�[1m�[31merror�[0m: deno task couldn't find deno.json(c) or package.json. See https://docs.deno.com/go/config
 ##[error]Process completed with exit code 1.

---

GitHub Actions: Hypatia Security Scan / Hypatia Neurosymbolic Analysis: fix(ci): repair unparseable permissions scalar (1 workflow file(s))

Conclusion: failure

View job details

##[group]Run github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63
 with:
   sarif_file: hypatia.sarif
   category: hypatia
   checkout_path: /home/runner/work/bofig/bofig
   ***REDACTED_SECRET_ASSIGNMENT***
   matrix: null
   wait-for-processing: true
 env:
   INSTALL_DIR_FOR_OTP: /home/runner/work/_temp/.setup-beam/otp
   INSTALL_DIR_FOR_ELIXIR: /home/runner/work/_temp/.setup-beam/elixir
 ##[endgroup]
 Job run UUID is 1d4226d7-bcde-4fdf-a282-37f7c13751af.
 ##[error]Path does not exist: hypatia.sarif

---

GitHub Actions: Deno CI / build: fix(ci): repair unparseable permissions scalar (1 workflow file(s))

Conclusion: failure

View job details

##[group]Run deno task lint
 �[36;1mdeno task lint�[0m
 shell: /usr/bin/bash -e {0}
 ##[endgroup]
 �[0m�[1m�[31merror�[0m: deno task couldn't find deno.json(c) or package.json. See https://docs.deno.com/go/config
 ##[error]Process completed with exit code 1.

---

📝 Summary

Summary by CodeRabbit

• Chores
  • Updated automated project checks to use read-only access.
  • Maintained existing workflow behaviour while reducing unnecessary permissions.
  • No changes were made to the application’s features or user-facing experience.

Walkthrough

The workflow removes the actions: read mapping and relies on the existing top-level permissions: read-all declaration.

Changes

Workflow permissions

Layer / File(s)	Summary
Remove redundant permission mapping .github/workflows/workflow-linter.yml	The workflow no longer defines a separate actions: read permission mapping. It uses permissions: read-all.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~2 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to f89bc

The workflow permission cleanup has no identified merge-blocking risk.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the CI YAML permissions parsing fix. It is specific to the main change, although the file-count suffix is unnecessary.
Description check	✅ Passed	The description accurately explains the YAML parse error, the semantic effect of removing the line, and the validation performed. It directly relates to the changeset.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🛠️ Fix failing CI checks

• Create stacked PR
• Commit on current branch

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks the workflow gate
One permission line departs its state
Read-all remains in view
The linting path stays true
Clean YAML hops ahead
No extra access is spread}

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

✅ Coding Agent task started: View task and status

The task will inspect the CI failures, validate its fix, and open a stacked fix pull request automatically.

Note: Fixing CI failures is a beta feature and may encounter errors. Expect some limitations and changes as we gather feedback and continue to improve it.

⏭️ 5 check(s) skipped — already failing on `main` (not caused by this PR)

• GitHub Actions: Hypatia Security Scan / 0_Hypatia Neurosymbolic Analysis.txt
• GitHub Actions: Elixir CI / 0_Build and test.txt
• GitHub Actions: Elixir CI / 0_elixir-ci _ Compile + test.txt
• GitHub Actions: Deno CI / 0_build.txt
• GitHub Actions: Governance / 0_governance _ Validate Hypatia Baseline.txt