fix(ci): add secrets:read to sop-tier-check workflow

SEV-1 #1413 follow-up: sop-tier-check.yml uses {{ secrets.SOP_TIER_CHECK_TOKEN }} in its env but lacked secrets:read permission. Without it, the env var substitution fails → token is empty → API calls get 401 → tier check fails. Same fix applied to qa-review/security-review/sop-checklist in PR #1498. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-18 11:44:29 +00:00
1 changed files with 1 additions and 0 deletions
@@ -71,6 +71,7 @@ jobs:
    permissions:
      contents: read
      pull-requests: read
+      secrets: read
    steps:
      - name: Check out base branch (for the script)
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2