Commit c3a8713
ci: drop workflow-perms cap on reusable-workflow callers
pr-checks.yml and unit-tests.yml only call reusable workflows. A caller's
workflow-level permissions cap the GITHUB_TOKEN for the called workflow, which
cannot request more than the caller grants. The contents: read block here was
stripping scopes the callees need:
- verifyFreezePeriod.yml needs issues: read (milestone lookup)
- checkMergeCommits.yml needs pull-requests: read
- publishTestResults.yml needs checks: write, pull-requests: write,
issues: read and actions: read
This is what broke validation (pr-checks.yml line 16, reported by @akurtakov).
Revert the permissions block on these two reusable-only callers; each reusable
workflow already declares its own least-privilege permissions. The contents:
read additions on the non-affected workflows in this PR are kept.
Signed-off-by: Arpit Jain <arpitjain099@gmail.com>1 parent 4c58ef6 commit c3a8713
2 files changed
Lines changed: 0 additions & 6 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
9 | 9 | | |
10 | 10 | | |
11 | 11 | | |
12 | | - | |
13 | | - | |
14 | | - | |
15 | 12 | | |
16 | 13 | | |
17 | 14 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
6 | 6 | | |
7 | 7 | | |
8 | 8 | | |
9 | | - | |
10 | | - | |
11 | | - | |
12 | 9 | | |
13 | 10 | | |
14 | 11 | | |
| |||
0 commit comments