Grant UK AI advisory worker secret-scanning access

[Copilot]

The UK AI resilience advisory could not verify secret-scanning hygiene because its worker token lacked access to secret-scanning alerts. This left required security evidence inaccessible and advisory conclusions incomplete.

• Worker permissions
  • Add least-privilege read access for secret-scanning alerts.
  • Regenerate the compiled workflow so the GitHub App token receives the permission.

permissions:
  security-events: read
  secret-scanning-alerts: read
  vulnerability-alerts: read

• Contract coverage
  • Assert the advisory worker retains the secret-scanning permission in workflow source.

• Fixes [advisory:uk-ai-resilience] [Advisory] UK AI operational resilience review for githubnext/gh-aw-workshop #124

[github-actions]

Workflow Validator Review

• test:unit — pass
• test:integration — fail
• test:load — pass
• docs:build — pass
• agentic-workflows compile — pass (0 exit, 41 warnings across repo, no errors)

test:integration failures

tests/integration/package-lifecycle.test.mjs — 4 failing subtests, all with the same root cause:

invalid Agentic Workflow manifest "<advisory|dashboard|root>/aw.yml": aw.yml:2:1: error: Unknown property: resources. Valid fields are: agents, branding, config, description, emoji, files, includes, license, manifest-version, min-version, ...

Failing tests:

• gh aw add installs the advisory package contract
• gh aw add installs the dashboard package contract
• gh aw add --force restores dashboard workflows and report modules
• gh aw update replaces workflows and restores package-owned assets

advisory/aw.yml, dashboard/aw.yml, and the root aw.yml all declare a resources field that the installed gh aw CLI schema does not recognize. This blocks package installation (gh aw add) end to end. Either the manifest schema needs a resources field, or these manifests need to drop/rename it to match the current CLI's supported fields.

compile output

agentic-workflows compile (via gh aw compile) succeeded (31/31 workflows compiled) with 41 warnings, none blocking. One warning applies to a file changed in this PR — flagged inline: .github/workflows/advisory-uk-ai-operational-resilience.md is missing concurrency.job-discriminator, so concurrent workflow_dispatch runs share one concurrency slot.

Generated by PR Reviewer / Agentic Workflow Validation for #214 · copilot · auto · 26 AIC · ⌖ 3.38 AIC · ⊞ 6.5K

Comments that could not be inline-anchored

.github/workflows/advisory-uk-ai-operational-resilience.md:78

gh aw compile warning: workflow_dispatch workflow has no concurrency.job-discriminator; the generated conclusion concurrency group is shared by all dispatches of this workflow. Set a discriminator (for example, ${{ github.run_id }}) to give each dispatch its own slot.

done

[pelikhan]

@copilot apply comment #214 (review)

[Copilot]

Workflow Validator Review

• test:unit — pass...

Addressed the applicable concurrency warning in 70213a5: added job-discriminator: ${{ github.run_id }}, regenerated the lock file, and updated the contract test. Strict compilation now completes with no warnings; npm run test:unit passes (90 tests).