Skip to content

Commit 4be57eb

Browse files
committed
ci: drop workflow-perms cap on reusable-workflow callers
pr-checks.yml and unit-tests.yml only call reusable workflows. A caller's workflow-level permissions cap the GITHUB_TOKEN for the called workflow, which cannot request more than the caller grants. The contents: read block here was stripping scopes the callees need: - verifyFreezePeriod.yml needs issues: read (milestone lookup) - checkMergeCommits.yml needs pull-requests: read - publishTestResults.yml needs checks: write, pull-requests: write, issues: read and actions: read This is what broke validation (pr-checks.yml line 16, reported by @akurtakov). Revert the permissions block on these two reusable-only callers; each reusable workflow already declares its own least-privilege permissions. The contents: read additions on the non-affected workflows in this PR are kept. Signed-off-by: Arpit Jain <arpitjain099@gmail.com>
1 parent a74e27f commit 4be57eb

2 files changed

Lines changed: 0 additions & 6 deletions

File tree

.github/workflows/pr-checks.yml

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -9,9 +9,6 @@ on:
99
pull_request:
1010
branches: [ master ]
1111

12-
permissions:
13-
contents: read
14-
1512
jobs:
1613
check-freeze-period:
1714
uses: eclipse-platform/eclipse.platform.releng.aggregator/.github/workflows/verifyFreezePeriod.yml@master

.github/workflows/unit-tests.yml

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,9 +6,6 @@ on:
66
types:
77
- completed
88

9-
permissions:
10-
contents: read
11-
129
jobs:
1310
check:
1411
uses: eclipse-platform/eclipse.platform.releng.aggregator/.github/workflows/publishTestResults.yml@master

0 commit comments

Comments
 (0)