fix: resource not accessible by integration

[hieu-w]

Summary

Adds actions: read permission to the zizmor job in the security scan workflow to fix "resource not accessible by integration" errors.

Changes

• Grant actions: read on the zizmor job alongside existing contents: read and security-events: write permissions

Why

The zizmor job analyzes GitHub Actions workflows and needs read access to Actions resources. Without this permission, the job fails when running via the GitHub App integration.

Test plan

• Run the security scan workflow on a test repo and confirm the zizmor job completes without permission errors
• Confirm zizmor SARIF is still uploaded to code scanning

---

Note

Low Risk
Single read-only permission on one CI job; aligns zizmor with existing scan jobs and does not broaden write or deployment access.

Overview
Fixes the zizmor job in the security scan workflow failing with "resource not accessible by integration" when the scan runs via the GitHub App (notably on private repos).

Adds actions: read to that job’s permissions so it matches CodeQL and Semgrep, which already use the same trio (actions: read, contents: read, security-events: write). zizmor needs Actions API access to analyze workflow files.

CHANGELOG records the fix under Unreleased → Fixed.

^{Reviewed by Cursor Bugbot for commit 9f7a73b. Bugbot is set up for automated code reviews on this repo. Configure here.}

[Mrtenz]

Blocking this while waiting for response on Slack.