From fb213fe9bf597b9fdb6cc32e05a979ef1f8a310d Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Mon, 21 Sep 2026 09:07:34 +0100
Subject: [PATCH] fix(ci): grant the calling job the union of the callee's
 permissions (scorecard)

---
 .github/workflows/scorecard.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 434aa88..1665b7d 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -21,7 +21,9 @@ permissions:
 jobs:
   scorecard:
     permissions:
+      actions: read
       contents: read
+      id-token: write
       security-events: write
     uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@210f14e753c80064ec1bcae72f1d654dd9b0e687
     secrets: inherit