fix(ci): drop the unused top-level actions: read from scorecard-reusable

[hyperpolymath]

Outcome

Every caller of scorecard-reusable.yml pinned at bd0df9ea or later that grants the estate-default contents: read (plus its own job needs) hits a 0-second startup_failure — OSSF Scorecard has never run once on enaction-engine (20/20), cadastra, or svalinn. This removes the cause at source.

Cause

The estate-wide security-compliance sweep (0ced540e) added top-level permissions: actions: read to this reusable. No job in the file uses it — the only job (scorecard) declares its own block (security-events: write, id-token: write). But a reusable's top-level permissions must be grantable by every caller, so the unused line broke callers that don't grant actions: read. rust-ci-reusable.yml documents the identical lesson from its own history ("the previous actions: read here was used by no job in this file, so every caller granting only contents: read failed to start").

Differential: consent-aware-web + project-ovine pin 81dbf2dd (pre-sweep, top-level contents: read only) → green. enaction-engine/cadastra/svalinn pin bd0df9ea (post-sweep) → all startup_fail.

Change

Delete the unused actions: read; keep contents: read; comment mirrors rust-ci-reusable's. Strictly permission-narrowing — callers granting more are unaffected; callers granting less can now start.

Scope note (no over-claim)

This helps callers only at the SHA they pin: repos pinned to bd0df9ea stay broken until they either re-pin past this fix or add actions: read caller-side (enaction-engine#39 does the latter and merges independently). cadastra / svalinn / chronicles-of-slavia should re-pin to a ref containing this commit at their next standards bump.

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[gitar-bot]

Note

Automatic reviews are paused because your trial's included automatic processing has been used for this period. Upgrade now, or comment "Gitar review" to run a review anytime.
Learn more

Code Review ✅ Approved

Removes the unused top-level actions: read permission from the scorecard reusable workflow to unblock strict callers. No issues found.

Auto-approved and auto-merge armed: No blocking issues found.
Please see Auto-approve Docs for details on setting custom approval criteria. — merges when pipeline and required approvals pass.

Options

Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Compact

gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[gitar-bot]

Gitar has auto-approved this PR and enabled auto-merge (configure)