add pull-requests: read permission to verify-dockerfile workflow

[kernelsam]

The verify-dockerfile-refreshed-at-updated reusable workflow needs pull-requests: read to function correctly with the callers permissions.

[github-actions]

🤖 Claude Code Review

PR Code Review

Code Quality

✅ Code style - Simple workflow file, no style violations.

✅ No commented-out code - Clean file.

✅ Meaningful variable names - N/A for this workflow file.

✅ DRY principle - Delegates to a reusable workflow from senzing-factory/build-resources, which is the correct pattern.

✅ No defects - The workflow is minimal and correct. Permissions follow least-privilege: contents: read and pull-requests: read at the job level, with permissions: {} at the top level (denying all by default).

✅ CLAUDE.md review - No issues. The project config is general and environment-agnostic.

Testing

✅ N/A - This is a CI workflow file, not application code. No unit/integration tests required.

Documentation

✅ README - No update needed for a CI workflow addition.

✅ API docs - N/A.

✅ Inline comments - The workflow is self-explanatory; no comments needed.

⚠️ CHANGELOG.md - Not included in this diff. If this project maintains a changelog, adding a CI workflow entry may be expected. Low priority for infrastructure-only changes.

✅ Markdown formatting - The YAML file is not a Markdown file. No CommonMark issues.

Security

✅ No hardcoded credentials - None present.

✅ Input validation - N/A for workflow.

✅ Proper error handling - N/A for workflow; failure behavior is inherited from the reusable workflow.

✅ No sensitive data in logs - N/A.

✅ No license files - No .lic files or AQAAAD-prefixed strings present.

---

Summary: This is a clean, minimal addition of a reusable CI workflow. The permission model correctly uses least-privilege (permissions: {} globally, scoped permissions at the job level). No issues found. The only minor note is a potential CHANGELOG entry, which may or may not be required by project convention.

Automated code review analyzing defects and coding standards

[github-actions]

Super-linter summary

Language	Validation result
CHECKOV	Pass ✅
GITHUB_ACTIONS	Pass ✅
GITHUB_ACTIONS_ZIZMOR	Pass ✅
GITLEAKS	Pass ✅
GIT_MERGE_CONFLICT_MARKERS	Pass ✅
JSCPD	Pass ✅
PRE_COMMIT	Pass ✅
SPELL_CODESPELL	Pass ✅
TRIVY	Pass ✅
YAML	Pass ✅
YAML_PRETTIER	Pass ✅

All files and directories linted successfully

For more information, see the GitHub Actions workflow run

Powered by Super-linter