fix(ci): grant callers the permissions their reusable workflows declare

[hyperpolymath]

GitHub refuses these runs at workflow-creation time: Error calling workflow ... The workflow is requesting '<perm>', but is only allowed '<none>'. A workflow_call job must grant a superset of the callee's declared permissions. This adds the canonical grant (actions: read, contents: read, security-events: write) that the healthy repos already carry.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 1dd0ffa3-f45a-4731-903e-c0ac1819cdd9

📥 Commits

Reviewing files that changed from the base of the PR and between f7bbda4 and 1aefe38.

📒 Files selected for processing (2)

• .github/workflows/governance.yml
• .github/workflows/secret-scanner.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (7)

• GitHub Check: scan / gitleaks
• GitHub Check: hypatia / Hypatia Neurosymbolic Analysis
• GitHub Check: scan / shell-secrets
• GitHub Check: scan / rust-secrets
• GitHub Check: Analyze (actions)
• GitHub Check: lint-workflows
• GitHub Check: lint-workflows

🧰 Additional context used

🪛 YAMLlint (1.37.1)

.github/workflows/governance.yml

[error] 35-35: syntax error: mapping values are not allowed here

(syntax)

🔇 Additional comments (2)

.github/workflows/governance.yml (1)

35-38: LGTM!

.github/workflows/secret-scanner.yml (1)

19-20: LGTM!

---

📝 Summary

Summary by CodeRabbit

• Security
  • Updated automated governance and secret-scanning checks with the permissions required to read repository workflow information and publish security results.

Walkthrough

The governance and secret-scanning jobs now declare explicit GitHub Actions permissions. The changes add actions: read and security-events: write, while preserving contents: read.

Changes

Workflow permissions

Layer / File(s)	Summary
Declare workflow job permissions .github/workflows/governance.yml, .github/workflows/secret-scanner.yml	The jobs now declare explicit read permissions for Actions and contents, plus write permission for security events where required.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Bug fix

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the main change: granting reusable workflow callers the permissions declared by their callees.
Description check	✅ Passed	The description explains the workflow-creation failure and the permissions added in the changeset.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks the workflow gate
Read permissions now align their state
Security events may safely write
Governance runs with scope set right
Secret scans proceed in light}

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud