fix(ci): give callers the union of the reusable's declared permissions

[hyperpolymath]

Job-level permissions: replace the workflow-level block, so a job block that lists only some keys silently drops the rest and GitHub refuses the call (The workflow is requesting 'id-token: write'/'contents: read', but is only allowed '<none>').

This sets each calling job's block to the union of the workflow-level grants and the callee's declared permissions (max level per key), validated by re-parsing the file before commit.

[coderabbitai]

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: ff285b66-b2cb-4bdf-b4cc-ab9b3509c417

📥 Commits

Reviewing files that changed from the base of the PR and between 8c18135 and 5708919.

📒 Files selected for processing (2)

• .github/workflows/scorecard-enforcer.yml
• .github/workflows/scorecard.yml

 _____________________________________________________
< Making Elsa proud by letting it go...to production. >
 -----------------------------------------------------
  \
   \   (\__/)
       (•ㅅ•)
       / 　 づ

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud