From 4abb8d4e0c99b05706acc2bd9afc0c04566147b1 Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Sun, 20 Sep 2026 23:04:29 +0000
Subject: [PATCH] =?UTF-8?q?fix(ci):=20make=20the=20Hypatia=20wrapper=20sta?=
 =?UTF-8?q?rt=20=E2=80=94=20grant=20what=20the=20reusable=20requests?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The called workflow declares `permissions: security-events: write`. This caller
granted `security-events: read`, so GitHub failed the call at startup on every
trigger and this repository has never produced a Hypatia check or a finding.

Aligns the wrapper with the estate's working template (`pull-requests: write`,
`security-events: write`), passes `secrets: inherit` so the read-only
HYPATIA_SCAN_PAT reaches the reusable, and names the caller `hypatia` so the
published check is the canonical `hypatia / Hypatia Neurosymbolic Analysis`.
---
 .github/workflows/hypatia-scan.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml
index 942a5cc..6ff9238 100644
--- a/.github/workflows/hypatia-scan.yml
+++ b/.github/workflows/hypatia-scan.yml
@@ -12,8 +12,8 @@ on:
 
 permissions:
   contents: read
-  security-events: read
-
+  pull-requests: write
+  security-events: write
 jobs:
   hypatia:
     uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9