Problem

The main-ci.yml workflow was failing with the error:

The workflow is requesting 'actions: read, statuses: write', but is only allowed 'actions: none, statuses: none'

This occurred because the workflow calls the shared __shared-ci.yml workflow, but wasn't passing the required permissions that the shared workflow needs to execute properly.

Root Cause

The __shared-ci.yml workflow declares these required permissions:

permissions:
  actions: read
  contents: read
  security-events: write
  statuses: write
  id-token: write

However, the ci job in main-ci.yml was only passing a subset of these permissions:

permissions:
  contents: read
  security-events: write
  id-token: write

This left the shared workflow without the actions: read and statuses: write permissions it needs to function.

Solution

Added the missing actions: read and statuses: write permissions to the ci job in main-ci.yml so that the job-level permissions now match exactly what the shared workflow requires.

This approach is consistent with the existing security model and follows the same pattern used by other workflows in the repository that call shared workflows.

Validation

• ✅ All workflow YAML files pass syntax validation
• ✅ Project builds and lints successfully
• ✅ Permissions now align between caller and shared workflow

Fixes the GitHub Actions workflow validation error while maintaining minimal changes and existing functionality.

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.