chore: Bump amcheste/gh-workflows/.github/workflows/reusable-monthly-dependency-release.yml from 1.1.0 to 1.1.3

[dependabot]

Bumps amcheste/gh-workflows/.github/workflows/reusable-monthly-dependency-release.yml from 1.1.0 to 1.1.3.

Release notes

Sourced from amcheste/gh-workflows/.github/workflows/reusable-monthly-dependency-release.yml's releases.

v1.1.3

• chore: release v1.1.3 @amcheste-ai-agent[bot] (#18)
• chore: release v1.1.3 @amcheste-ai-agent[bot] (#17)
• fix: drop read-all workflow permissions in reusable-scorecard @amcheste-ai-agent[bot] (#16)

v1.1.2

• chore: release v1.1.2 @amcheste-ai-agent[bot] (#15)
• chore: release v1.1.2 @amcheste-ai-agent[bot] (#14)
• fix: grant security-events/id-token write in SAST and Scorecard callers @amcheste-ai-agent[bot] (#13)

v1.1.1

• chore: release v1.1.1 @amcheste-ai-agent[bot] (#12)
• chore: release v1.1.1 @amcheste-ai-agent[bot] (#11)
• fix: grant pull-requests:read for gitleaks PR scans @amcheste-ai-agent[bot] (#7)

Changelog

Sourced from amcheste/gh-workflows/.github/workflows/reusable-monthly-dependency-release.yml's changelog.

[1.1.3] - 2026-07-09

Fixed

• reusable-scorecard.yml: dropped permissions: read-all from the documented caller-stub example. read-all grants nothing for id-token (it has no read level, only none/write), so a caller following the example got startup_failure on every Scorecard run — read-all looked generous but was actually the same bug as the missing-permission case it was meant to guard against.

Retroactive note (2026-07-20): this should have been a major bump. It changes what a caller must grant to avoid startup_failure, which is a breaking change under this project's own versioning contract (see centralized-ci-workflows.md). It shipped as a patch because the commit used fix: instead of fix!:, so the semver-suggestion tooling (and the human cutting the release) never saw a major-bump signal. Combined with v1.1.1 and v1.1.2 below, every caller that took these "routine" Dependabot patch bumps silently lost CI across gitleaks, SAST, and scorecard — not discovered until a manual fleet audit on 2026-07-20.

[1.1.2] - 2026-07-09

Fixed

• reusable-sast.yml and reusable-scorecard.yml: their jobs request security-events: write (and reusable-scorecard.yml also id-token: write), which the documented caller-stub examples didn't grant — same class of bug as v1.1.1's gitleaks fix, this time on the SAST and Scorecard callers.

Retroactive note (2026-07-20): same breaking-change classification issue as v1.1.3 above — shipped as fix:/patch, should have been fix!:/major.

[1.1.1] - 2026-07-08

Fixed

• reusable-gitleaks.yml: the documented caller-stub example was missing pull-requests: read, which gitleaks-action needs to list a PR's commits and compute its scan range. Without it, a caller following the example 403s on every pull-request-triggered run.

Retroactive note (2026-07-20): same breaking-change classification issue as v1.1.3 above — shipped as fix:/patch, should have been fix!:/major. This is the first instance of the pattern; see the engineering-handbook incident writeup for the full timeline across all three releases and its fleet-wide impact.

Commits

• 1ae9599 Merge pull request #18 from amcheste/develop
• cb69ebd Merge pull request #17 from amcheste/chore/release-v1.1.3
• c4bb54a chore: release v1.1.3
• 32a329a Merge pull request #16 from amcheste/fix/scorecard-reusable-workflow-permissions
• 23b4647 fix: drop read-all workflow permissions in reusable-scorecard
• 4be92ef Merge pull request #15 from amcheste/develop
• f9a5b97 Merge pull request #14 from amcheste/chore/release-v1.1.2
• 655f576 chore: release v1.1.2
• 3488f5a Merge pull request #13 from amcheste/fix/sast-scorecard-permissions
• 965c5cb fix: grant security-events/id-token write in SAST and Scorecard callers
• Additional commits viewable in compare view

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.