From 8e81bcb7ea4e4411d627cdce0064defcefe1264e Mon Sep 17 00:00:00 2001 From: Sinabina Date: Fri, 17 Jul 2026 12:02:58 -0700 Subject: [PATCH] =?UTF-8?q?ci:=20grant=20security-events=20write=20to=20th?= =?UTF-8?q?e=20OSV=20caller=20job=20=E2=80=94=20reusable=20workflow=20requ?= =?UTF-8?q?ires=20it=20at=20startup?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-Authored-By: Claude Fable 5 --- .github/workflows/osv-scanner.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/osv-scanner.yml b/.github/workflows/osv-scanner.yml index 91674a982..8c8b4f9b1 100644 --- a/.github/workflows/osv-scanner.yml +++ b/.github/workflows/osv-scanner.yml @@ -24,6 +24,10 @@ jobs: permissions: actions: read contents: read + # Required by the reusable workflow's own top-level permissions block — + # GitHub validates the caller grants a superset AT STARTUP, even with + # upload-sarif: false (nothing is actually uploaded; see #2117 upstream). + security-events: write uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@9a498708959aeaef5ef730655706c5a1df1edbc2 # v2.3.8 with: upload-sarif: false