From 71908d51f7670a6b7366ab624f021cc377ca235d Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Mon, 21 Sep 2026 09:07:26 +0100
Subject: [PATCH 1/2] fix(ci): grant the calling job the union of the callee's
 permissions (scorecard)

---
 .github/workflows/scorecard-enforcer.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/scorecard-enforcer.yml b/.github/workflows/scorecard-enforcer.yml
index 7b8e069..4199d57 100644
--- a/.github/workflows/scorecard-enforcer.yml
+++ b/.github/workflows/scorecard-enforcer.yml
@@ -16,5 +16,6 @@ jobs:
   scorecard:
     permissions:
       contents: read
+      id-token: write
       security-events: write
     uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@210f14e753c80064ec1bcae72f1d654dd9b0e687

From 57089191a5fce4fd5ff71be39594e45bf556120f Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Mon, 21 Sep 2026 09:07:28 +0100
Subject: [PATCH 2/2] fix(ci): grant the calling job the union of the callee's
 permissions (scorecard)

---
 .github/workflows/scorecard.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 434aa88..1665b7d 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -21,7 +21,9 @@ permissions:
 jobs:
   scorecard:
     permissions:
+      actions: read
       contents: read
+      id-token: write
       security-events: write
     uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@210f14e753c80064ec1bcae72f1d654dd9b0e687
     secrets: inherit