Migrate to reusable workflows

[mbrousset-ledger]

This PR migrates workflows to use centralized reusable workflows from LedgerHQ/ledger-app-workflows.

[ledger-wiz-cspm-secret-detection]

Wiz Scan Summary

Scanner	Findings
Sensitive Data	-
Secrets	-
IaC Misconfigurations	2
SAST Findings	-
Software Management Findings	-
Total	2

View scan details in Wiz

To detect these findings earlier in the dev lifecycle, try using Wiz Code VS Code Extension.

In general, the problem is fixed by adding an explicit permissions: block that limits GITHUB_TOKEN to the least privileges necessary. This can be set at the workflow root (applies to all jobs) or at the job level. Since our snippet shows only a single job and we are invoking a reusable workflow, the safest, non-breaking approach is to add a job-level permissions: block under jobs.analyse, so the reusable workflow runs with constrained permissions. For a CodeQL analysis that only needs to read the repository contents, contents: read is a reasonable minimal baseline.

Concretely, in .github/workflows/codeql.yml, under the existing analyse job (line 13 onwards), we will insert a permissions: section at the same indentation level as name, uses, and secrets. We will set:

permissions:
  contents: read

This does not alter any existing logic or behavior of the workflow other than constraining token rights. No imports or additional methods are needed, as this is purely a YAML configuration change.

To fix this, explicitly define least-privilege permissions for the workflow so the GITHUB_TOKEN does not inherit potentially broad defaults. Since this workflow only dispatches a reusable unit-test workflow and does not itself perform any repository modifications, a safe minimal set is read-only access to repository contents.

The best way to do this without changing existing functionality is to add a top-level permissions: block (at the same indentation level as on: and jobs:) with contents: read. This will apply to all jobs in the workflow, including the unit_tests job that calls the reusable workflow, unless that reusable workflow overrides permissions internally. No other changes to the job definition are necessary.

Concretely, in .github/workflows/unit-tests.yml, insert:

permissions:
  contents: read

between the on: block and the jobs: block (e.g., after line 10 or 11 in the provided snippet). This requires no imports or additional methods, as it’s purely a YAML configuration change for GitHub Actions.

[mbrousset-ledger]

Closing this PR for now.