fix(ci): fix configuration for breaking change notification workflow

[jameslamb]

Contributes to rapidsai/shared-workflows#560

Fixes misconfigurations in the GitHub Actions workflow that generates Notifications when PRs are labeled breaking.

Any other changes come from making the configuration for this workflow identical across all RAPIDS repos.

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[jameslamb]

/ok to test

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 68331c1f-dbd3-4f45-8768-557b77467913

📥 Commits

Reviewing files that changed from the base of the PR and between ee7fada and 159f9c3.

📒 Files selected for processing (1)

• .github/workflows/trigger-breaking-change-alert.yaml

---

📝 Walkthrough

Summary by CodeRabbit

• Chores
  • Updated breaking change alert workflow configuration to enhance security and notification delivery.

Walkthrough

This PR hardens the breaking-change alert workflow by restricting default GitHub token permissions and updating the Slack notification secret configuration. The trigger-notifier job now uses a new secret mapping sourced from NV_SLACK_BREAKING_CHANGE_NOTIFIER_APP instead of the previous NV_SLACK_BREAKING_CHANGE_ALERT secret.

Changes

Workflow Security Hardening

Layer / File(s)	Summary
GitHub token permissions and secret configuration .github/workflows/trigger-breaking-change-alert.yaml	A top-level permissions: {} block is added to restrict the workflow's default GitHub token permissions. The trigger-notifier job's secret mapping is updated from NV_SLACK_BREAKING_CHANGE_ALERT to slack-webhook-url sourced from NV_SLACK_BREAKING_CHANGE_NOTIFIER_APP.

---

🎯 2 (Simple) | ⏱️ ~8 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and specifically describes the main change: fixing the configuration for the breaking change notification workflow in CI.
Description check	✅ Passed	The description is directly related to the changeset, explaining the purpose of fixes and standardization across RAPIDS repos.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[jakirkham]

Thanks James! 🙏

[jakirkham]

Looks like some other repos (like RMM and cuDF) don't have this. Should we add this throughout?

[jameslamb]

(repeating what I said offline for the history here)

Only rmm and cudf specifically were missing this. I've added it in both.

• add default permissions block in trigger-breaking-change-alert config rapidsai/rmm#2438
• fix(ci): fix configuration for breaking change notification workflow cudf#22732

[jameslamb]

/merge