fix(ci): re-arm governance — grant actions: read

[hyperpolymath]

Governance is currently disarmed on main in this repo

The standards pin bump landed while this caller granted only contents: read.
The reusable at that pin requires actions: read, so the workflow dies at
startup and reports no checks at all — main looks green because the entire
governance suite is absent, not passing.

Measured on this repo's main: governance.yml latest run = startup_failure,
governance check count = 0 (the healthy count is 15).

This PR adds the one missing line.

Verified: on bofig, aggregate-library, boinc-boinc, cloudguard-cli the same
one-line change took the gate from 0 checks to 15. On cloud-sync-tuner the
cured run is fully green (15 jobs, 0 failures).

🤖 Generated with Claude Code

https://claude.ai/code/session_01QMTyDv9CoJo5PfeNzyp519

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 59efc902-e10b-4713-bdeb-6257d317c636

📥 Commits

Reviewing files that changed from the base of the PR and between fa631d5 and 8ce7ca1.

📒 Files selected for processing (1)

• .github/workflows/governance.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

🔇 Additional comments (1)

.github/workflows/governance.yml (1)

30-30: LGTM!

---

📝 Summary

Summary by CodeRabbit

• Chores
  • Updated workflow permissions to allow read-only access to action metadata.

Walkthrough

The governance workflow now includes top-level read-only permission for GitHub Actions.

Changes

Governance workflow

Layer / File(s)	Summary
Add Actions read permission .github/workflows/governance.yml	The workflow grants actions: read alongside the existing contents permission.

Priority: ➖ Normal — Schedule the governance permission fix because the missing read access prevents the workflow from starting and suppresses all 15 governance checks.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to 8ce7c

The governance workflow can read Actions metadata required to start its reusable checks while retaining read-only permissions. No current merge-blocking risk is identified.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the main change: granting read-only access to the Actions permission to restore the governance workflow.
Description check	✅ Passed	The description directly explains the startup failure, the missing actions: read permission, and the expected restoration of governance checks.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks the workflow gate
Read-only Actions now set the state
Contents remain in view
Permissions stay few
The burrow ships on time, not late}

_{Comment @coderabbitai help to get the list of available commands.}