fix docker-verify-refreshed-at-updated workflow

[kernelsam]

Add pull-requests: read permission to docker-verify-refreshed-at-updated.yaml and remove incorrectly named verify-dockerfile-refreshed-at-updated.yaml.

[github-actions]

🤖 Claude Code Review

PR Code Review

Summary: This PR consolidates two GitHub Actions workflow files into one by deleting a redundant verify-dockerfile-refreshed-at-updated.yaml and adding the missing pull-requests: read permission to docker-verify-refreshed-at-updated.yaml.

---

Code Quality

• ✅ Style guide - YAML workflow files follow consistent formatting conventions used across the repo.
• ✅ No commented-out code - The removed comment block (lines 3-4 in the original docker-verify-refreshed-at-updated.yaml) described a required status check and is correctly removed.
• ✅ Meaningful variable names - N/A for workflow YAML; job/step names are descriptive.
• ✅ DRY principle - This PR improves DRY by deleting the redundant verify-dockerfile-refreshed-at-updated.yaml, which was a duplicate of the reusable workflow call already in docker-verify-refreshed-at-updated.yaml.
• ✅ Defects - No bugs or logic errors. The deleted file had no branches filter or concurrency block, meaning it would trigger on PRs to any branch and could create duplicate runs — its removal is correct.
• ✅ CLAUDE.md - No issues; the project config is general-purpose and appropriate.

Testing

• ✅ No code logic changed - This is a CI/CD workflow-only change; no unit or integration tests are applicable.

Documentation

• ✅ README - No user-facing behavior change; no update needed.
• ✅ API docs - N/A.
• ✅ Inline comments - The removed comment was stale/misleading (it referenced "Verify Dockerfiles REFRESHED_AT Updated / Dockerfile Check Status" as a required status check), so its deletion is appropriate.
• ❌ CHANGELOG.md - The CHANGELOG was not updated. Depending on project convention, infrastructure/CI changes may warrant a changelog entry.
• ✅ Markdown formatting - N/A for YAML files; no markdown changes in this PR.

Security

• ✅ No hardcoded credentials - None present.
• ✅ Input validation - N/A.
• ✅ Permissions - pull-requests: read is the minimum required permission added to an otherwise locked-down job (permissions: {}). The addition is appropriate and correctly scoped to the job level, not the workflow level.
• ✅ No sensitive data in logs - N/A.
• ✅ No license files - No .lic files or AQAAAD-prefixed content.

---

Summary

This is a clean, minimal change that fixes a missing permission and removes a duplicate workflow file. The only minor point is the CHANGELOG was not updated, which may or may not be required by project convention for CI-only changes.

Automated code review analyzing defects and coding standards

[github-actions]

Super-linter summary

Language	Validation result
CHECKOV	Pass ✅
GITHUB_ACTIONS	Pass ✅
GITHUB_ACTIONS_ZIZMOR	Pass ✅
GITLEAKS	Pass ✅
GIT_MERGE_CONFLICT_MARKERS	Pass ✅
JSCPD	Pass ✅
PRE_COMMIT	Pass ✅
SPELL_CODESPELL	Pass ✅
TRIVY	Pass ✅
YAML	Pass ✅
YAML_PRETTIER	Pass ✅

All files and directories linted successfully

For more information, see the GitHub Actions workflow run

Powered by Super-linter