fix(ci): grant the secret-scanner reusable its required job permissions #133

	# SPDX-License-Identifier: MPL-2.0
	name: Secret Scanner
	on:
	pull_request:
	push:
	branches: [main]
	concurrency:
	group: ${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: true
	permissions:
	contents: read
	jobs:
	scan:
	# The reusable's gitleaks job requests pull-requests: write (PR summary
	# comment) and actions: read (workflow-run metadata) at job level; the
	# caller must grant at least that or the run startup-fails.
	permissions:
	contents: read
	pull-requests: write
	actions: read
	uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236
	secrets: inherit
	trufflehog:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4
	with:
	fetch-depth: 0
	- name: TruffleHog Secret Scan
	uses: trufflesecurity/trufflehog@main
	with:
	extra_args: --only-verified --fail

Provide feedback