ci: grant gitleaks the pull-requests scope it needs

The job failed before scanning anything: listing a pull request's commits
needs pull-requests: read, and only contents: read was granted.

PR comments are also disabled. Posting one needs pull-requests: write, and
Dependabot pull requests run with a read-only token, so leaving comments on
would have made every dependency PR fail for a reason unrelated to secrets.
Findings still fail the check and appear in the job log.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: mschmicking

.github/workflows/secret-scan.yml

@@ -14,6 +14,9 @@ on:
 
 permissions:
   contents: read
+  # gitleaks lists the pull request's commits to scan only what the PR adds; without
+  # this the API call 403s and the job fails before scanning anything.
+  pull-requests: read
 
 jobs:
   gitleaks:
@@ -28,5 +31,11 @@ jobs:
       - uses: gitleaks/gitleaks-action@v2
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # Findings belong in the job log and the failed check, not in PR comments:
+          # writing a comment needs pull-requests: write, and a Dependabot PR gets a
+          # read-only token, so leaving this on makes those runs fail spuriously.
+          GITLEAKS_ENABLE_COMMENTS: false
+          # Do not phone home with usage data.
+          GITLEAKS_ENABLE_UPLOAD_ARTIFACT: false
           # GITLEAKS_LICENSE is only required for organisation accounts; personal
           # repositories run without it.