fix(ci): give callers the union of the reusable's declared permissions

[hyperpolymath]

Job-level permissions: replace the workflow-level block, so a job block that lists only some keys silently drops the rest and GitHub refuses the call (The workflow is requesting 'id-token: write'/'contents: read', but is only allowed '<none>').

This sets each calling job's block to the union of the workflow-level grants and the callee's declared permissions (max level per key), validated by re-parsing the file before commit.

[coderabbitai]

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 8ec52376-5fb8-4947-aca6-1bec891066a1

📥 Commits

Reviewing files that changed from the base of the PR and between 5364cbe and 3c7f54e.

📒 Files selected for processing (1)

• .github/workflows/governance.yml

 ____________________________________
< No tests? Bold. Approval? Also no. >
 ------------------------------------
  \
   \   \
        \ /\
        ( )
      .( o ).

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud