Recent commits introduced a breaking change that appears undocumented.
Breaking Changes
1. Smoke-test workflow loses the repository permission required by its installation check
Commit(s): da5fffe35f7ad7d3191c6d42fc93929751a0d0fd
PR: #1526
What broke: .github/workflows/smoke-test-install.yml:8-9 changes the workflow-level token permission to contents: none, but the same workflow passes secrets.GITHUB_TOKEN at lines 26 and 43 and uses it while running gh-aw add at line 85 to fetch workflow sources from elastic/ai-github-actions. With the token no longer granted repository contents access, the install loop fails; run 29395309927 recorded the failure in the installation step.
Evidence: The pinned gh-aw v0.48.1 implementation fetches remote workflow files through the GitHub Contents API (pkg/parser/remote_fetch.go:639-666), so the smoke test no longer validates installation as intended.
Why undocumented: PR #1526 describes the permission change generically and warns that workflows may need additional permissions, but it does not identify this workflow, document that contents: none is intentional, or provide a compatible configuration/migration note. No README, DEVELOPING, RELEASE, or release-note update documents the smoke-test failure.
Suggested fix: Set contents: read for this workflow (or explicitly configure the required read permission and verify the smoke-test installation path), then rerun the workflow to confirm all sources install and compile.
Suggested Actions
What is this? | From workflow: Trigger Breaking Change Detector
Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.
Recent commits introduced a breaking change that appears undocumented.
Breaking Changes
1. Smoke-test workflow loses the repository permission required by its installation check
Commit(s): da5fffe35f7ad7d3191c6d42fc93929751a0d0fd
PR: #1526
What broke:
.github/workflows/smoke-test-install.yml:8-9changes the workflow-level token permission tocontents: none, but the same workflow passessecrets.GITHUB_TOKENat lines 26 and 43 and uses it while runninggh-aw addat line 85 to fetch workflow sources fromelastic/ai-github-actions. With the token no longer granted repository contents access, the install loop fails; run 29395309927 recorded the failure in the installation step.Evidence: The pinned
gh-awv0.48.1 implementation fetches remote workflow files through the GitHub Contents API (pkg/parser/remote_fetch.go:639-666), so the smoke test no longer validates installation as intended.Why undocumented: PR #1526 describes the permission change generically and warns that workflows may need additional permissions, but it does not identify this workflow, document that
contents: noneis intentional, or provide a compatible configuration/migration note. No README, DEVELOPING, RELEASE, or release-note update documents the smoke-test failure.Suggested fix: Set
contents: readfor this workflow (or explicitly configure the required read permission and verify the smoke-test installation path), then rerun the workflow to confirm all sources install and compile.Suggested Actions
smoke-test-install.ymland verify run 29395309927What is this? | From workflow: Trigger Breaking Change Detector
Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.