Treat reusable-workflow secret inheritance as privileged execution

[rmcdaniel]

Problem

The public qualification scanner marks a job as privileged when it has write permissions, requests an environment, or contains an explicit ${{ secrets.* }} expression. A reusable-workflow caller with secrets: inherit has none of those shapes, so it is not treated as privileged when the workflow also supports workflow_dispatch. The scanner can therefore accept an unguarded manual-dispatch job that invokes a local or external reusable workflow and passes repository or organization secrets from a non-target ref.

For a local reusable workflow, the selected dispatch ref also selects the called workflow source. This permits contributor-controlled workflow code from an unprotected ref to receive inherited credentials while the portable trust scan remains green.

Acceptance criteria

• Any job-level secrets declaration, including secrets: inherit and explicit reusable-workflow secret maps, is classified as privileged.
• A privileged reusable-workflow caller reachable from workflow_dispatch is rejected unless its effective condition fails closed outside the repository target ref.
• Pull-request and other untrusted contribution paths cannot pass inherited or explicitly mapped release, deployment, package-publish, cross-repository, or environment credentials.
• Local reusable workflows cannot use an unprotected caller ref to select contributor-controlled workflow source with inherited secrets.
• Focused regressions reject unguarded local and external secrets: inherit calls and unguarded explicit secret maps, while accepting a protected-target caller and a genuinely credential-free reusable workflow.

Delete when every reusable-workflow credential path participates in the same protected-ref and untrusted-contribution checks as direct secret expressions.

[rmcdaniel]

Source implementation landed in 2f0a963a5962 on main.

Required public qualification passed: https://github.com/durable-workflow/.github/actions/runs/29903469370

This issue remains open until its required public completion evidence is verified.

[rmcdaniel]

Completion evidence verified.

• Source: 2f0a963a5962
• Source qualification: https://github.com/durable-workflow/.github/actions/runs/29903469370
• Immutable candidate qualification: https://github.com/durable-workflow/.github/actions/runs/29903469684

The candidate run verified the protected target set, immutable public artifacts, digest-bound privileged handoffs, and fresh-checkout recording after all repository peers landed. A post-landing read-only audit of the same public target completed without a new finding.

[rmcdaniel]

Completed in 2f0a963a5962 on main.

Required public qualification passed: https://github.com/durable-workflow/.github/actions/runs/29903469684