fix(ci): update reusable workflow SHAs to @7fdc2705df74b4e352d2a1cde3e87a5923fdf329

.github/workflows/architecture-enforcement.yml

@@ -8,6 +8,7 @@ on:
   push:
     branches: [main, develop]
 permissions:
+  actions: read
   contents: read
 # Cancel superseded runs on the same ref so a rapid sequence of pushes
 # to a feature branch does not pile up jobs against the Pro-plan 40-job

.github/workflows/boj-build.yml

@@ -7,6 +7,7 @@ on:
     branches: [main, master]
   workflow_dispatch:
 permissions:
+  actions: read
   contents: read
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}

.github/workflows/casket-pages.yml

@@ -7,6 +7,7 @@ on:
     branches: [main, master]
   workflow_dispatch:
 permissions:
+  actions: read
   contents: read
   pages: write
   id-token: write

.github/workflows/cflite_batch.yml

@@ -3,6 +3,7 @@ name: ClusterFuzzLite Batch
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
 permissions:
+  actions: read
   contents: read
 on:
   schedule:

.github/workflows/cflite_pr.yml

@@ -3,6 +3,7 @@ name: ClusterFuzzLite PR
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
 permissions:
+  actions: read
   contents: read
 on:
   pull_request:

.github/workflows/chapel-ci.yml

@@ -24,6 +24,7 @@
 
 name: Chapel CI
 permissions:
+  actions: read
   contents: read
 on:
   push:

.github/workflows/clusterfuzzlite.yml

@@ -22,6 +22,7 @@ on:
     - cron: '0 2 * * 0' # Sunday 02:00 UTC
   workflow_dispatch:
 permissions: read-all
+  actions: read
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true

.github/workflows/codeql.yml

@@ -17,6 +17,7 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 permissions:
+  actions: read
   contents: read
 jobs:
   analyze:

.github/workflows/d-ci.yml

@@ -8,6 +8,7 @@
 
 name: D CI
 permissions:
+  actions: read
   contents: read
 on:
   push:

.github/workflows/dogfood-gate.yml

@@ -13,6 +13,7 @@ on:
   push:
     branches: [main, master]
 permissions:
+  actions: read
   contents: read
 jobs:
   # ---------------------------------------------------------------------------

.github/workflows/e2e.yml

@@ -27,6 +27,7 @@ on:
       - 'bindings/**'
   workflow_dispatch:
 permissions: read-all
+  actions: read
 concurrency:
   group: e2e-${{ github.ref }}
   cancel-in-progress: true

.github/workflows/echidna-verify.yml

@@ -37,6 +37,7 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 permissions:
+  actions: read
   contents: read
 jobs:
   agda-lol:

.github/workflows/ffi-full-integration.yml

@@ -5,6 +5,7 @@ name: FFI Full Integration
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
 permissions:
+  actions: read
   contents: read
 on:
   push:

.github/workflows/governance.yml

@@ -9,6 +9,7 @@ on:
   workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
 
 jobs:

.github/workflows/hypatia-scan.yml

@@ -11,6 +11,7 @@ on:
   workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
   security-events: write
 

.github/workflows/idris2-ci.yml

@@ -3,6 +3,7 @@ name: Idris 2 CI
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
 permissions:
+  actions: read
   contents: read
 on:
   push:

.github/workflows/instant-sync.yml

@@ -10,6 +10,7 @@ on:
   release:
     types: [published]
 permissions:
+  actions: read
   contents: read
 jobs:
   dispatch:

.github/workflows/mirror.yml

@@ -7,8 +7,9 @@ on:
     branches: [main]
   workflow_dispatch:
 permissions:
+  actions: read
   contents: read
 jobs:
   mirror:
-    uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236
+    uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@7fdc2705df74b4e352d2a1cde3e87a5923fdf329
     secrets: inherit

.github/workflows/ocaml-ci.yml

@@ -8,6 +8,7 @@
 
 name: OCaml CI
 permissions:
+  actions: read
   contents: read
 on:
   push:

.github/workflows/pages.yml

@@ -5,6 +5,7 @@ on:
     branches: [main, master]
   workflow_dispatch:
 permissions:
+  actions: read
   contents: read
   pages: write
   id-token: write

.github/workflows/publish-crates.yml

@@ -13,6 +13,7 @@ on:
         default: 'true'
         type: boolean
 permissions:
+  actions: read
   contents: read
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true

.github/workflows/publish-ghcr.yml

@@ -8,6 +8,7 @@ on:
     types: [published]
   workflow_dispatch:
 permissions:
+  actions: read
   contents: read
   packages: write
 jobs:

.github/workflows/publish-jsr.yml

@@ -15,6 +15,7 @@ on:
         default: 'true'
         type: boolean
 permissions:
+  actions: read
   contents: read
 jobs:
   publish:

.github/workflows/publish-npm.yml

@@ -24,6 +24,7 @@ on:
           - javascript
           - typescript
 permissions:
+  actions: read
   contents: read
 jobs:
   publish-javascript:

.github/workflows/push-email-notify.yml

@@ -7,6 +7,7 @@ name: Push email notification
 on:
   push: {}
 permissions:
+  actions: read
   contents: read
 jobs:
   notify:

.github/workflows/release.yml

@@ -29,6 +29,7 @@ on:
         default: true
         type: boolean
 permissions:
+  actions: read
   contents: read
 jobs:
   validate:

.github/workflows/scorecard.yml

@@ -9,6 +9,7 @@ on:
   workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
 
 jobs:

.github/workflows/secret-scanner.yml

@@ -10,12 +10,13 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 permissions:
+  actions: read
   contents: read
 jobs:
   scan:
     permissions:
       contents: read
       pull-requests: write
       actions: read
-    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236
+    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@7fdc2705df74b4e352d2a1cde3e87a5923fdf329
     secrets: inherit

.github/workflows/spark-theatre-gate.yml

@@ -11,10 +11,11 @@ on:
   push:
     branches: [main, master]
 permissions:
+  actions: read
   contents: read
 jobs:
   spark-theatre-gate:
-    uses: hyperpolymath/standards/.github/workflows/spark-theatre-gate.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236
+    uses: hyperpolymath/standards/.github/workflows/spark-theatre-gate.yml@7fdc2705df74b4e352d2a1cde3e87a5923fdf329
     with:
       paths: "."
       enforce_zero_contract: false

.github/workflows/trustfile.yml

@@ -16,6 +16,7 @@ on:
     branches: [main, master]
   workflow_dispatch:
 permissions:
+  actions: read
   contents: read
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}

.github/workflows/zig-ffi.yml

@@ -3,6 +3,7 @@ name: Zig FFI Build
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
 permissions:
+  actions: read
   contents: read
 on:
   push: