Replace scan-snyk with scan-grype and fix workflow permissions (#857)

Co-authored-by: claude-helper-bot[bot] <3031036+claude-helper-bot[bot]@users.noreply.github.com>

Author: claude-helper-bot[bot]

.github/workflows/code-checks.yml

@@ -6,6 +6,10 @@ on:
     branches:
       - "**"
 
+permissions:
+  actions: read
+  contents: read
+
 jobs:
   gosec:
     uses: ckotzbauer/actions-toolkit/.github/workflows/toolkit-lint.yml@5eba4a9063c75ab16cc2c98722ea493f71159331 # 0.53.1

.github/workflows/create-release.yml

@@ -7,6 +7,12 @@ on:
         description: "Version"
         required: true
 
+permissions:
+  actions: read
+  contents: write
+  id-token: write
+  packages: write
+
 jobs:
   release:
     uses: ckotzbauer/actions-toolkit/.github/workflows/toolkit-release-goreleaser.yml@5eba4a9063c75ab16cc2c98722ea493f71159331 # 0.53.1

.github/workflows/release-job-image.yml

@@ -34,6 +34,11 @@ on:
       ghcr-password:
         required: false
 
+permissions:
+  actions: read
+  contents: read
+  packages: read
+
 jobs:
   release-job-image:
     permissions:

.github/workflows/review.yml

@@ -4,6 +4,11 @@ on:
   pull_request:
     types: [opened, synchronize, reopened]
 
+permissions:
+  actions: read
+  contents: read
+  pull-requests: write
+
 jobs:
   review:
     uses: ckotzbauer/actions-toolkit/.github/workflows/toolkit-review.yml@5eba4a9063c75ab16cc2c98722ea493f71159331 # 0.53.1

.github/workflows/scan-grype.yml

@@ -0,0 +1,22 @@
+name: scan-grype
+
+on:
+  schedule:
+    - cron: "0 12 * * 1"
+  workflow_dispatch: {}
+
+permissions:
+  contents: read
+  packages: read
+  security-events: write
+
+jobs:
+  scan-scan:
+    uses: ckotzbauer/actions-toolkit/.github/workflows/toolkit-scan.yml@0.55.1
+    with:
+      docker-tag: ghcr.io/ckotzbauer/sbom-operator:latest
+
+  scan-vcn:
+    uses: ckotzbauer/actions-toolkit/.github/workflows/toolkit-scan.yml@0.55.1
+    with:
+      docker-tag: ghcr.io/ckotzbauer/sbom-operator/vcn:latest

.github/workflows/test.yml

@@ -6,6 +6,11 @@ on:
     branches:
       - "**"
 
+permissions:
+  actions: read
+  contents: read
+  packages: read
+
 jobs:
   test:
     uses: ckotzbauer/actions-toolkit/.github/workflows/toolkit-build-test.yml@5eba4a9063c75ab16cc2c98722ea493f71159331 # 0.53.1