fix(ci): grant actions: read so the security workflow can start

[WomB0ComB0]

What

This repo's security workflow has never run. Every invocation ends in startup_failure — GitHub rejects the run at creation, so no job starts and no logs are produced. That is why it was invisible in normal triage: startup_failure is not in the default status set most tooling scans for, and there is nothing to read even when you find it.

Root cause

security.yml is a thin caller for the org-wide reusable workflow resq-software/.github/.github/workflows/security-scan.yml. That workflow's CodeQL and SARIF-upload jobs declare actions: read.

An explicit permissions: block sets every unlisted scope to none. Since the caller listed only contents, security-events and pull-requests, the nested jobs requested a permission the caller did not grant — and GitHub refuses to create the run.

Evidence

The correlation across the org is exact, with no exceptions:

repo	actions: read	last security run
npm	✅	success
dotnet-sdk	✅	success
landing	✅	success
research	✅	success
programs	✅	success
crates	❌	startup_failure
dev	❌	startup_failure
docs	❌	startup_failure
viz	❌	startup_failure

Ruled out along the way: the pinned reusable-workflow SHA resolves and the file exists at it; the languages/submodules inputs are declared and correctly typed; the reusable workflow's own permissions block matches the caller's other three scopes; resq-software/.github is public, so repo access policy does not apply. Notably the working and broken repos pin the same SHA — so it is the caller, not the callee.

Fix

One line, plus the rationale comment copied verbatim from the repos that already had it — this was diagnosed once before and simply never propagated to the other four.

permissions:
  actions: read      # <- added
  contents: read
  security-events: write
  pull-requests: read

Read-only. Grants no write capability.

Verification

• actionlint clean
• YAML parses; permissions.actions == "read"
• The real check is this PR itself: security should now actually start and run instead of startup_failure

Companion PRs opened against crates, dev, docs and viz — all four carry the identical change.

Summary by CodeRabbit

• Chores
  • Updated security workflow permissions to support automated code scanning.
  • Documented the read-only access scope for improved transparency.

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: a4b4cb9a-b303-499d-9c45-a2cc3e6e120a

📥 Commits

Reviewing files that changed from the base of the PR and between 31b1c25 and bbb08ec.

📒 Files selected for processing (1)

• .github/workflows/security.yml

---

📝 Walkthrough

Walkthrough

The security workflow now grants actions: read at the workflow level. Comments explain its use by nested CodeQL and SARIF-upload jobs. Other unspecified permissions remain denied.

Changes

Security workflow permissions

Layer / File(s)	Summary
Grant Actions read permission .github/workflows/security.yml	Adds workflow-level actions: read permission and documents its read-only scope and use by nested security jobs.

Estimated code review effort: 1 (Trivial) | ~2 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: granting actions: read so the security workflow can start.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/security-workflow-actions-read

Warning

Review ran into problems

🔥 Problems

Git: Failed to clone repository. Please run the @coderabbitai full review command to re-trigger a full review. If the issue persists, set path_filters to include or exclude specific files.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}