ci: sync with netresearch/.github templates/skill

[CybotTM]

Merging this brings the repository in line with two template changes in netresearch/.github, and nothing else.

• netresearch/.github#451 — the secret scan is named after betterleaks, the tool it has run since netresearch/.github#112. The check reports as betterleaks / Secret Scanning instead of gitleaks / Secret Scanning, and the reusable is called as betterleaks.yml.
• netresearch/.github#452 — the dependency auto-merge passes the organisation App's two secrets, so a merge can be made with an App token and the merge commit gets a CI run. Until the App is granted Contents and Pull requests write access the merge falls back to GITHUB_TOKEN, as today, with a warning.

Where branch protection requires gitleaks / Secret Scanning, the requirement is swapped to betterleaks / Secret Scanning when this pull request is merged.

The file list was checked mechanically against the two changes before this description was written; any other file would have stopped the rollout for this repository.

Assisted by claude-code:claude-opus-5 — Session

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: e2c81933-c6ed-4b7c-a6bb-38185cfff64b

📥 Commits

Reviewing files that changed from the base of the PR and between dcda141 and 4da970d.

📒 Files selected for processing (2)

• .github/workflows/auto-merge-deps.yml
• .github/workflows/security.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The auto-merge workflow now passes project App credentials as explicit reusable-workflow inputs and limits secret propagation. The security workflow renames the scanning job to betterleaks, references the betterleaks reusable workflow, and updates its comment. Existing permissions remain unchanged.

Priority: ⬇️ Low

Change: Other

Merge Risk: ⚪ Minimal · up to 4da97

The workflow updates preserve existing trust and permission boundaries, and no current merge-blocking defect is established.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly identifies the CI synchronization with the canonical netresearch/.github templates. It matches the main changes.
Description check	✅ Passed	The description directly explains both workflow changes and their relationship to the template synchronization objective.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

✨ Simplify code

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 1 package(s) with unknown licenses.

See the Details below.

License Issues

.github/workflows/security.yml

Package	Version	License	Issue Type
netresearch/.github/.github/workflows/betterleaks.yml	main	Null	Unknown License

OpenSSF Scorecard

Package	Version	Score	Details
actions/netresearch/.github/.github/workflows/betterleaks.yml	main	Unknown	Unknown

Scanned Files

• .github/workflows/security.yml

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[CybotTM]

Self-review: 4da970d

The bot review this pull request demands is unsatisfiable (Copilot quota wall or repeated bot failures on this head). The diff on this head was reviewed by the PR author; this comment is the on-the-record attestation the merge gate reads back. It stops matching on the next push.

[CybotTM]

Checked after the merge (this pull request was merged at 20:31 UTC by the session that opened it; this comment came later and reviews nothing before that merge):

• Both changed files are byte-identical to templates/skill/ in netresearch/.github at its current main (SHA-256 compared for auto-merge-deps.yml and security.yml).
• The renamed job calls .github/workflows/betterleaks.yml, which exists on netresearch/.github main, and ran green here.
• The App secrets only take effect once the App holds contents: write and pull-requests: write. Today it holds neither, so the reusable's token mint fails, it warns, and merging falls back to GITHUB_TOKEN as before (auto-merge-deps leaves main unverified in the 51 repositories without a merge queue .github#450).

Assisted by claude-code:claude-opus-5-5 — Session