[rgarcia]

Summary

Part of removing the static ANTHROPIC_API_KEY / OPENAI_API_KEY org secrets from GitHub Actions. The reusable workflows in kernel/security-workflows are moving to its llm-credentials composite action (documented in that repo's README, "llm-credentials action"), which exchanges the job's GitHub OIDC token for short-lived Anthropic/OpenAI credentials via workload identity federation. Reusable workflows can only use id-token: write if the caller grants it.

• .github/workflows/semgrep.yml: add id-token: write to the top-level permissions: (existing entries kept) so the called semgrep workflow can mint an OIDC token.
• .github/workflows/vuln-remediation.yml: same, for the called vuln-remediation workflow.

No other changes. Neither file in this repo references the API key secrets directly (they pass secrets: inherit), and rg -n 'ANTHROPIC_API_KEY|OPENAI_API_KEY' .github returns nothing.

Safe to merge now: the permission is unused until kernel/security-workflows switches these reusable workflows to the action, which happens only after every caller has the permission.

Testing

• actionlint 1.7.7 (sha256-verified release binary) with shellcheck 0.10.0 on both changed workflows: no findings.
• No workflow was run live.

[rgarcia]

Picked ulziibay-kernel to review: touched the changed code in workflows; 33 pending

[rgarcia]

Picked JonnyShuali to review: these caller changes only add id-token: write, and he reviewed the llm-credentials action (security-workflows#36, #39); moved off ulziibay-kernel, who has 27 pending