[rgarcia]

Summary

Part of removing the static ANTHROPIC_API_KEY / OPENAI_API_KEY org secrets from GitHub Actions. The shared workflows in kernel/security-workflows are moving to its llm-credentials composite action (documented in that repo's README, "llm-credentials action"), which exchanges the job's GitHub OIDC token for short-lived model credentials through workload identity federation. Callers of those reusable workflows need to grant id-token: write for that exchange.

• .github/workflows/semgrep.yml: add id-token: write to the top-level permissions: block (existing entries kept).
• .github/workflows/vuln-remediation.yml: add id-token: write to the top-level permissions: block (existing entries kept).

Neither file references ANTHROPIC_API_KEY or OPENAI_API_KEY directly; both pass secrets: inherit, which is unchanged.

Safe to merge now: the permission is unused until kernel/security-workflows switches its semgrep.yml and vuln-remediation.yml to the action, which only happens after every caller has the permission.

Testing

• actionlint 1.7.7 (release tarball, sha256 verified) with shellcheck 0.10.0 on PATH, run on both changed workflows: 0 errors.
• rg -n 'ANTHROPIC_API_KEY|OPENAI_API_KEY' .github: no matches.
• No workflow was run live.

[rgarcia]

Picked ulziibay-kernel to review: recent commits in workflows; 33 pending

[rgarcia]

Picked JonnyShuali to review: these caller changes only add id-token: write, and he reviewed the llm-credentials action (security-workflows#36, #39); moved off ulziibay-kernel, who has 27 pending