Repository navigation

ci: grant write scopes to the jobs that need them instead of every jo… #732

	name: Security scan

	on:
	push:
	branches: [main]
	pull_request:
	branches: [main]
	schedule:
	- cron: '0 6 * * *'
	workflow_dispatch:

	permissions:
	contents: read

	jobs:
	scan:
	name: Secrets + CVE
	# The SARIF upload is the only thing here that writes anything.
	permissions:
	contents: read
	security-events: write
	uses: FerrLabs/.github/.github/workflows/reusable-security-scan.yml@e89ec1209ae561a7a1b910127ccbd926e77fa613 # main
	secrets: inherit