add pull-requests: read permission to verify-dockerfile workflow

[kernelsam]

The verify-dockerfile-refreshed-at-updated reusable workflow needs pull-requests: read to function correctly with the callers permissions.

[github-actions]

🤖 Claude Code Review

PR Code Review

Diff Summary: Adds pull-requests: read permission to the verify-dockerfile-refreshed-at-updated.yaml workflow.

---

Code Quality

✅ Style guide: Single-line YAML change, follows existing conventions.

✅ No commented-out code: N/A.

✅ Meaningful variable names: N/A.

✅ DRY principle: N/A.

✅ Defects: No bugs or logic errors. The permission addition is a minimal, targeted change. Adding pull-requests: read is appropriate if the reusable workflow needs to inspect PR data (e.g., to read PR metadata or comments to determine if a Dockerfile's REFRESHED_AT label was updated).

✅ CLAUDE.md: No issues; the project config is general and suitable for any developer.

---

Testing

✅ Unit/integration tests: Not applicable — this is a CI workflow permission change with no testable logic.

---

Documentation

✅ README: No update needed.

✅ API docs: N/A.

✅ Inline comments: The change is self-explanatory; no comment needed.

⚠️ CHANGELOG.md: No CHANGELOG entry is present. For workflow/CI changes this is often omitted, but if the project tracks all changes it may be worth a minor note.

✅ Markdown formatting: YAML file, not a Markdown document.

---

Security

✅ No hardcoded credentials: None present.

✅ Input validation: N/A for a workflow permission block.

✅ Proper error handling: N/A.

✅ No sensitive data in logs: N/A.

✅ No license files (.lic): None present.

Permission scope review: pull-requests: read is a read-only permission — it grants no write access. This follows the principle of least privilege. The permission is scoped only to the job that needs it, which is correct.

---

Summary

This is a minimal, low-risk change. The only minor item is the missing CHANGELOG entry, which may or may not be required depending on project conventions. The permission addition is appropriate and follows least-privilege principles.

Automated code review analyzing defects and coding standards

[github-actions]

Super-linter summary

Language	Validation result
CHECKOV	Pass ✅
GITHUB_ACTIONS	Pass ✅
GITHUB_ACTIONS_ZIZMOR	Pass ✅
GITLEAKS	Pass ✅
GIT_MERGE_CONFLICT_MARKERS	Pass ✅
JSCPD	Pass ✅
PRE_COMMIT	Pass ✅
SPELL_CODESPELL	Pass ✅
TRIVY	Pass ✅
YAML	Pass ✅
YAML_PRETTIER	Pass ✅

All files and directories linted successfully

For more information, see the GitHub Actions workflow run

Powered by Super-linter