fix(ci): grant the wrapper the permissions the reusable declares

[hyperpolymath]

GitHub refused the run: Invalid workflow file ... Error calling workflow ... The workflow is requesting 'actions: read', but is only allowed 'actions: none'. The calling job must grant actions: read for the reusable to start.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 1083dbe5-23ab-4ef1-9ba0-93b675904f6d

📥 Commits

Reviewing files that changed from the base of the PR and between fc7e328 and d256026.

📒 Files selected for processing (1)

• .github/workflows/hypatia-scan.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (19)

• GitHub Check: scan / rust-secrets
• GitHub Check: scan / gitleaks
• GitHub Check: scan / shell-secrets
• GitHub Check: hypatia / Hypatia Neurosymbolic Analysis
• GitHub Check: SQLite — generated overlay applies and views build
• GitHub Check: Idris2 — machine-check ABI proofs
• GitHub Check: Zig — build + test FFI reference impl
• GitHub Check: analyze (rust)
• GitHub Check: Hypatia neurosymbolic scan
• GitHub Check: Codegen — golden sample is up to date
• GitHub Check: Validate K9 contracts
• GitHub Check: cargo check (stable)
• GitHub Check: Validate eclexiaiser manifest
• GitHub Check: ABI ↔ FFI structural conformance
• GitHub Check: Groove manifest check
• GitHub Check: Validate A2ML manifests
• GitHub Check: panic-attack assail
• GitHub Check: Empty-linter (invisible characters)
• GitHub Check: Zig FFI builds + tests (Zig 0.14.0)

🔇 Additional comments (1)

.github/workflows/hypatia-scan.yml (1)

22-22: LGTM!

---

📝 Summary

Summary by CodeRabbit

• Chores
  • Updated automated workflow permissions to allow read access to workflow actions.

Walkthrough

The workflow-level permissions now include actions: read, alongside the existing contents, security-events, and pull-requests permissions.

Changes

Workflow permissions

Layer / File(s)	Summary
Add Actions read permission .github/workflows/hypatia-scan.yml	The workflow grants read access to the actions scope.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~2 minutes

Change: Bug fix

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description explains the GitHub error and the required permission, but it does not follow the required template. It omits the Summary, Changes, RSR Quality Checklist, Testing, and Screenshots sect…	Update the description to use the repository template. Include the change summary, key changes, checklist status, testing details, and screenshots or terminal output when applicable.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the CI permission change and matches the main change in the workflow.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Description check

Explanation

The description explains the GitHub error and the required permission, but it does not follow the required template. It omits the Summary, Changes, RSR Quality Checklist, Testing, and Screenshots sections.

• Fix all pre-merge checks with AI

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks the workflow bright
actions: read is set just right
Contents and alerts remain in line
Pull requests keep their write design
One small permission joins the queue}

_{Comment @coderabbitai help to get the list of available commands.}