Restrict token access in the secret scanning workflow

[albertvillanova]

This PR restricts the token access granted to the secret scanning job.

Motivation

The workflow declares no permissions block, so the job takes the repository default, and the checkout keeps the job's token in .git/config because persist-credentials defaults to true.

That matters here more than in a normal job: the scan step runs the scanner as a container with the working directory bind-mounted (docker run -v .:/tmp), so .git/config and the token in it are visible to a third-party image.

The scanner only reads the repository, and the checkout only needs the token for its own fetch, so neither the write scopes nor the persisted credential is used.

Solution

Declare the single scope the job needs, and stop persisting the credential into the mounted directory. Both settings match the same workflow in huggingface/transformers.

Changes

• Add a permissions block granting contents: read
• Set persist-credentials: false on the checkout, with a comment recording why

---

Note

Low Risk
CI-only hardening with no runtime or application behavior changes; reduces accidental token leakage to the scanner container.

Overview
Tightens secret-scanning CI so the job no longer inherits broad default token permissions or leaves credentials on disk where the TruffleHog container can read them.

Adds permissions: contents: read at workflow scope and sets persist-credentials: false on checkout, with a comment that the scan bind-mounts the workspace (including .git/config) into a third-party image.

^{Reviewed by Cursor Bugbot for commit 3f2b861. Bugbot is set up for automated code reviews on this repo. Configure here.}

[bot-ci-comment]

The docs for this PR live here. All of your documentation changes will be reflected on that endpoint. The docs are available until 30 days after the last update.

[qgallouedec]

and again, same as #6759 feel free to merge it, or wait for @McPatate's opinion if you think it's necessary.