[rgarcia]

Summary

Part of removing the static ANTHROPIC_API_KEY / OPENAI_API_KEY org secrets from GitHub Actions. The shared workflows in kernel/security-workflows are moving to its llm-credentials composite action (documented in that repo's README, "llm-credentials action"), which exchanges the job's GitHub OIDC token for short-lived model credentials through workload identity federation. That requires the calling workflow to grant id-token: write.

• .github/workflows/semgrep.yml: add id-token: write to the top-level permissions: block (existing entries kept), with a one-line comment.
• .github/workflows/vuln-remediation.yml: add id-token: write to the top-level permissions: block (existing entries kept), with a one-line comment.

Neither file references the API key secrets directly; both pass secrets via secrets: inherit, so nothing else changes.

Safe to merge now

The new permission is unused until kernel/security-workflows switches semgrep.yml and vuln-remediation.yml to the action, and that change merges only after every caller has the permission.

Testing

• actionlint 1.7.7 (release tarball, sha256 verified) with shellcheck 0.10.0 on PATH, run on both changed workflows: 0 errors.
• rg -n 'ANTHROPIC_API_KEY|OPENAI_API_KEY' .github: no matches.
• No workflow was run live.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
mcp	Ready	Preview	Nov 9, 2026 4:54pm UTC

[rgarcia]

Picked ulziibay-kernel to review: touched the changed code in workflows; 33 pending

[rgarcia]

Picked JonnyShuali to review: these caller changes only add id-token: write, and he reviewed the llm-credentials action (security-workflows#36, #39); moved off ulziibay-kernel, who has 27 pending