fix(ci): remove elevated permissions from gitleaks-action and disable comments

Author: hyperpolymath

.github/workflows/secret-scanner-reusable.yml

@@ -86,15 +86,7 @@ jobs:
     permissions:
       contents: read
       # gitleaks-action's `ScanPullRequest` posts a summary comment via
-      # the GitHub Issues/PR API. Without `pull-requests: write` it fails
-      # with "Resource not accessible by integration" AFTER the gitleaks
-      # scan itself succeeds. Reusable-workflow permission blocks
-      # OVERRIDE the caller's, so this MUST live here at source.
-      # See .git-private-farm#69 for the reproducing logs.
-      pull-requests: write
-      # Additional API calls inside `ScanPullRequest` (workflow-run
-      # metadata, PR-files endpoint) require `actions: read`.
-      actions: read
+      # the GitHub Issues/PR API. We disabled it via env vars below.
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
@@ -105,6 +97,8 @@ jobs:
         uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e # v3.0.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITLEAKS_ENABLE_COMMENTS: false
+          GITLEAKS_ENABLE_SUMMARY: false
 
   # Rust-specific: hardcoded crypto values. Self-skips when no Cargo.toml
   # is present, so this job is safe to run on non-Rust repos.

.github/workflows/secret-scanner.yml

@@ -15,13 +15,8 @@ permissions:
 
 jobs:
   scan:
-    # The reusable's gitleaks job requests pull-requests: write (PR
-    # summary comments, .git-private-farm#69) and actions: read. A
-    # called workflow cannot exceed the caller's grant — without these
-    # here every run dies at startup_failure.
+    # The reusable's gitleaks job no longer requests elevated permissions
     permissions:
       contents: read
-      pull-requests: write
-      actions: read
     uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@891b1ed6164478616cb3375f328c6487ccb13f80
     secrets: inherit