.github: fix startup_failure in cache-warming / sonar-branch-scan (reusable-workflow perms)

[lystopad]

Regression fix — startup_failure on main since #22677

The excessive-permissions cleanup (#22677, #22687) gave the reusable test leaves explicit permissions (actions: write for their merge-queue gh run cancel, pull-requests: read for sonar). GitHub validates a called workflow's declared permissions against the caller's grant at startup and rejects the whole run if the caller grants less. Callers that only granted contents: read therefore began failing to start:

Caller	Calls	Broke at	Effect
cache-warming	lint, sonar, test-bench, test-all-erigon, …	#22677	startup_failure, 33 checks dropped
sonar-branch-scan	sonar	#22677	startup_failure, 1 check dropped
cache-warming-kurtosis-cl-images	test-kurtosis-assertoor	#22687	startup_failure

Both cache-warming and sonar-branch-scan went success → startup_failure exactly at commit 6f7557ebec (#22677) and have failed on every main commit since — silently dropping ~34 checks per commit (this is the "134 → 99" drop visible in main's commit history). ci-gate was unaffected because it already grants actions: write + pull-requests: write; cache-warming-kurtosis-gloas-images is unaffected because its leaf (test-kurtosis-gloas) was never modified and still declares only contents: read — a clean control confirming the mechanism.

Fix

Grant each broken caller the union of its leaves' declared permissions:

• cache-warming → contents: read, actions: write, pull-requests: read
• sonar-branch-scan → contents: read, actions: write, pull-requests: read
• cache-warming-kurtosis-cl-images → contents: read, actions: write

These callers are orchestrators that must grant the leaf permission cap workflow-wide (exactly like ci-gate), so they're added to the excessive-permissions ignore list with a generalized justification.

Verification

• zizmor (real .github/zizmor.yml, audit enabled): exit 0, "No findings to report."
• actionlint clean on the diff (the pre-existing concurrency.queue note is unrelated).
• make lint = 0 issues.
• Post-merge confirmation: the push-triggered Cache Warming and SonarCloud Branch Scan runs on main should return to success (from startup_failure).

Note / lesson

Root cause was mine: when adding the leaves' permissions: in #22677/#22687 I didn't account for GitHub's caller-must-grant rule for reusable workflows, so non-ci-gate callers broke. This restores them without weakening the least-privilege scoping.

[Copilot]

Pull request overview

Fixes a GitHub Actions regression where caller workflows began failing at startup_failure after reusable “leaf” workflows started declaring stricter permissions:; GitHub requires the caller to grant at least the permissions requested by the called workflow.

Changes:

• Grant actions: write and (where needed) pull-requests: read at the workflow level for orchestrator workflows that call reusable test leaves.
• Add the affected orchestrators to the zizmor excessive-permissions ignore list with updated rationale.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
.github/zizmor.yml	Ignores orchestrator workflows for excessive-permissions with updated rationale.
.github/workflows/sonar-branch-scan.yml	Expands caller permissions to satisfy sonar.yml reusable workflow requirements.
.github/workflows/cache-warming.yml	Expands caller permissions to satisfy all called reusable workflows’ requirements.
.github/workflows/cache-warming-kurtosis-cl-images.yml	Adds actions: write so the called kurtosis workflow’s job-level permission grant is satisfiable.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.