docs(code-quality): note callers pass secrets: inherit for consistency (backend#1420)

[LukasWodka]

Header-comment-only change to the code-quality.yml reusable. Documents the fleet-wide convention (backend#1420) that callers pass secrets: inherit even though this workflow uses no secrets — a no-op bounded by the permissions: block, adopted to clear Cursor Bugbot's recurring (false-positive) "omits secrets inheritance" finding.

Companion to the four caller PRs: docs#79, tracebloc-website#454, model-zoo#117, start-training#33.

No behaviour change. Parent: backend#1420

🤖 Generated with Claude Code

---

Note

Low Risk
Comment-only change to workflow documentation; no runtime, permissions, or secret usage changes.

Overview
Header comments only in the reusable code-quality.yml adoption example—no workflow behavior change.

The sample caller now includes secrets: inherit with a note below it. The old text said callers do not need that line; it now explains the fleet convention from backend#1420: callers pass secrets: inherit for consistency even though this reusable workflow references no secrets and only needs contents: read. That inheritance is documented as a no-op bounded by the job permissions: block, mainly to silence recurring Cursor Bugbot false positives about missing secret inheritance.

^{Reviewed by Cursor Bugbot for commit d06af4e. Bugbot is set up for automated code reviews on this repo. Configure here.}

[aptracebloc]

Approving the caller PRs — they're correct and a genuine no-op today. Flagging a reservation on the convention itself, since it's about to become fleet-wide precedent.

The "harmless no-op" framing is accurate but conditional: secrets: inherit is a no-op only while the shared code-quality.yml references no secrets. Because it's a shared, org-wide callee, the day that workflow gains any step reading ${{ secrets.X }} — intentionally, by accident, or via a compromised PR to tracebloc/.github — every caller passing inherit silently hands it that repo's entire secret set. Not-inheriting is the least-privilege posture that contains that blast radius — the same ethos as the SHA-pinning we apply to third-party actions.

So the reservation is with the mechanism, not the goal: we're changing security-relevant config across ~10 repos to silence a Bugbot false positive, when a .cursor/BUGBOT.md rule ("don't flag missing secrets: inherit on callers of the secretless code-quality reusable") kills the same recurring noise with zero config change and none of the above — and it's the exact flywheel we already adopted in the #1304 BUGBOT.md fan-out.

Not blocking — the current PRs are safe and I've approved them. But I'd like to revisit before this is cemented as the fleet convention; the BUGBOT.md-rule approach looks strictly cleaner. At minimum the caller comment should state the condition ("a no-op while this reusable references no secrets; revisit if that changes") rather than an unqualified "harmless."

[aptracebloc]

Approving. See my comment on this PR: safe as documented today, but I'd revisit the mechanism (a .cursor/BUGBOT.md rule) before cementing secrets:inherit as the fleet convention.