fix(ci): fix configuration for breaking change notification workflow

[jameslamb]

Contributes to rapidsai/shared-workflows#560

Fixes misconfigurations in the GitHub Actions workflow that generates Notifications when PRs are labeled breaking.

Any other changes come from making the configuration for this workflow identical across all RAPIDS repos.

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[jameslamb]

/ok to test

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 6442618a-6a39-4b28-ac1f-07955dab7f08

📥 Commits

Reviewing files that changed from the base of the PR and between 3a84fbe and 0d94733.

📒 Files selected for processing (1)

• .github/workflows/trigger-breaking-change-alert.yaml

---

📝 Walkthrough

Summary by CodeRabbit

• Chores
  • Updated workflow configuration for internal CI/CD process to enhance security by refining permission and credential handling for automated notifications.

Walkthrough

This PR hardens the GitHub Actions workflow security posture by replacing inherited secrets and permissions with explicit, minimal grants. The trigger-notifier job now specifies only the contents: read permission needed and explicitly maps the slack-webhook-url secret instead of inheriting all secrets.

Changes

Workflow permissions and secrets configuration

Layer / File(s)	Summary
Trigger-notifier job permissions and secrets .github/workflows/trigger-breaking-change-alert.yaml	The trigger-notifier job permissions change from inherited to explicit contents: read, and secrets handling changes from secrets: inherit to an explicit mapping providing slack-webhook-url from NV_SLACK_BREAKING_CHANGE_NOTIFIER_APP.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

Possibly related PRs

• rapidsai/rmm#2373: Also updates the trigger-breaking-change-alert.yaml workflow configuration and the trigger-notifier job's permission and secrets settings.

Suggested reviewers

• gforsyth
• bdice

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and specifically describes the main change: fixing the configuration of the breaking change notification workflow in CI.
Description check	✅ Passed	The description is directly related to the changeset, explaining the purpose of the workflow fix and referencing the relevant issue and consistency goals across repositories.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

Warning

Review ran into problems

🔥 Problems

Stopped waiting for pipeline failures after 30000ms. One of your pipelines takes longer than our 30000ms fetch window to run, so review may not consider pipeline-failure results for inline comments if any failures occurred after the fetch window. Increase the timeout if you want to wait longer or run a @coderabbit review after the pipeline has finished.

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[jakirkham]

Thanks James! 🙏

[jameslamb]

/merge