Several GitHub Actions workflows were failing at startup because their permission model no longer satisfied the requirements of the reusable Starflow workflows they invoke. This updates the callers to declare valid token scopes and keeps elevated access limited to the one workflow that needs it. - **Reusable workflow callers** - Add `permissions: read-all` to workflows that only invoke reusable workflows with read-only requirements: - `qa.yaml` - `security-scan.yaml` - `tics.yaml` - **Policy workflow** - Add explicit **job-scoped** permissions to the `policy` reusable-workflow call instead of elevating the whole workflow token. - Preserve the write scope needed for security reporting while keeping the rest of the workflow narrowly scoped. - **Permission model** - Standardize read-only callers on a single top-level declaration. - Keep `security-events: write` isolated to the policy job, alongside the minimum read scopes required by the called workflow. ```yaml permissions: read-all jobs: test: uses: canonical/starflow/.github/workflows/test-python.yaml@main ``` ```yaml jobs: policy: permissions: actions: read contents: read pull-requests: read security-events: write uses: canonical/starflow/.github/workflows/policy.yaml@main ```