From 997e52c410c6d5dc35179a29f5664cdc6f5c5961 Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Mon, 6 Jul 2026 22:49:31 +0100
Subject: [PATCH] fix(ci): make OSSF Scorecard caller valid (perms / drop
 timeout-minutes)

Reusable scorecard caller failed at startup: needed security-events+id-token
(reusable perms capped to caller grant) and/or an illegal timeout-minutes on the
uses: job. Verified with actionlint. Pin preserved.
---
 .github/workflows/scorecard.yml | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 0912a3e..d59bb1e 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -16,5 +16,4 @@ jobs:
       security-events: write
       id-token: write
     uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@d7c22711e830e1f383846472f6e9b99debdb201e
-    timeout-minutes: 10
-    secrets: inherit
\ No newline at end of file
+    secrets: inherit