ci: Secret Scanner caller must grant the reusable's job permissions (… #289

	# SPDX-License-Identifier: MPL-2.0
	name: PHP Security Check

	on:
	push:
	branches: [main, master]
	pull_request:

	# Estate guardrail: scope push to default branches so a PR fires once (not
	# push+PR), and cancel superseded runs. Safe — read-only PR-triggered check.
	concurrency:
	group: ${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: true

	permissions:
	contents: read

	jobs:
	security:
	runs-on: ubuntu-latest
	permissions:
	contents: read
	steps:
	- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
	- name: PHP Security Scan
	run: \|
	# Check for dangerous functions
	DANGEROUS=$(grep -rE 'eval\s\(\|exec\s\(\|system\s\(\|passthru\s\(\|shell_exec\s\(\|`.\$' --include="*.php" . 2>/dev/null \| grep -v 'vendor/' \| head -10 \|\| true)
	if [ -n "$DANGEROUS" ]; then
	echo "⚠️ Potentially dangerous PHP functions found:"
	echo "$DANGEROUS"
	fi

	# Check for SQL injection patterns
	SQLI=$(grep -rE '\$_(GET\|POST\|REQUEST).query\|mysqli_query.\$_' --include="*.php" . 2>/dev/null \| grep -v 'vendor/' \| head -5 \|\| true)
	if [ -n "$SQLI" ]; then
	echo "⚠️ Potential SQL injection patterns:"
	echo "$SQLI"
	fi

	# Check for XSS patterns
	XSS=$(grep -rE 'echo\s+\$_(GET\|POST\|REQUEST)' --include="*.php" . 2>/dev/null \| grep -v 'vendor/' \| head -5 \|\| true)
	if [ -n "$XSS" ]; then
	echo "⚠️ Potential XSS patterns (unescaped output):"
	echo "$XSS"
	fi

	echo "✅ PHP security scan completed"

Provide feedback