### Problem/Motivation Apply least-privilege access to CI/CD variables by scoping them via environment: keywords (build, deploy/release, deploy/bot) merged into each job. Verify variable scoping with env-check guards. Remove the merge_request_event rule from bot-dry-run to prevent unmaskable secrets from leaking in fork MR logs. ### Work items - Commit(s): [09e164580e](https://git.drupalcode.org/project/project_analysis/-/commit/09e164580e8d), [427e17bf60](https://git.drupalcode.org/project/project_analysis/-/commit/427e17bf608b), [22e843a426](https://git.drupalcode.org/project/project_analysis/-/commit/22e843a4264a), [acb195baba](https://git.drupalcode.org/project/project_analysis/-/commit/acb195baba3a), [62c9b92b7a](https://git.drupalcode.org/project/project_analysis/-/commit/62c9b92b7a6d) ### Credit - Implemented by: @bbrala - Reviewed / helped by: @cmlara --- *Filed retroactively as part of the Drupal 12 rector coverage effort. Closed as fixed; credit to be applied to the contributors listed above.* *AI was used extensively to build this work and to file this issue. See [Dries Buytaert: AI-generated Rector rules for Drupal](https://dri.es/ai-generated-rector-rules-for-drupal) and [Björn Brala: Drupal Rector rules are config, not code. Mostly.](https://www.linkedin.com/pulse/drupal-rector-rules-config-code-mostly-bj%C3%B6rn-brala-vfpwe/).*