SRE-901: Stop handing CI more Vault reach than it uses

[TimDiekmann]

Applies the CI Vault narrowing from hashintel/hash#9160 to this repo.

• secrets: inherit dropped from the renovate job. The pinned reusable workflow reads no secrets.* — the Vault address comes from vars.VAULT_ADDR, a repo variable, which secrets: inherit never carried.
• contents: write → read. The reusable workflow declares contents: read for itself, so the Renovate job's token is already read-only in the current scheduled runs. The caller-side write only reached this workflow's own validate job, which checks out and runs jq/actionlint.

Related links

• SRE-901 (internal)
• SRE-901: Stop handing CI more Vault reach than it uses hash#9160 — the same change in hash

What tests cover this?

actionlint v1.7.12 on the changed file: clean. Renovate is proven green under contents: read, since that is already its effective permission today.

[cursor]

PR Summary

Low Risk
Permission and secret-scoping changes only; Renovate already ran with read-only contents, and validate only needs checkout plus linting.

Overview
Reduces CI token and secret exposure in the housekeeping workflow to match the least privilege the Renovate path already effectively had.

Workflow-level contents: write is changed to contents: read, so the default GITHUB_TOKEN for jobs in this file (including validate on PRs) is no longer write-capable. secrets: inherit is removed from the renovate job that calls hashintel/.github’s housekeeping-dependencies.yml, since that reusable workflow does not consume caller secrets (Vault uses vars.VAULT_ADDR instead).

^{Reviewed by Cursor Bugbot for commit f89fee4. Bugbot is set up for automated code reviews on this repo. Configure here.}

[Copilot]

Pull request overview

Reduces the default GitHub Actions token scope for the housekeeping workflow to match the Renovate reusable workflow’s actual needs, limiting CI’s Vault exposure and repository write permissions.

Changes:

• Downgrades workflow permissions.contents from write to read.
• Removes secrets: inherit from the renovate job invoking the pinned reusable workflow.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.