Skip to content

ci: a release's CI may read other runs' artifacts - #6

Merged
Sunrisepeak merged 1 commit into
mainfrom
fix/release-actions-read
Nov 7, 2026
Merged

Sunrisepeak merged 1 commit into
mainfrom
fix/release-actions-read

Conversation

@Sunrisepeak

Copy link
Copy Markdown
Member

The v1.2.0 release run did not start (startup_failure): ci.yml's jobs request actions: read to borrow the backend main built (#5), and a called workflow's jobs are granted no more than the caller's job, whose permissions were the workflow's contents: read. The ci job of release.yml now grants contents: read and actions: read.

Co-authored-by: speak-agent [email protected]

@Sunrisepeak
Sunrisepeak merged commit 00b9bd6 into main Nov 7, 2026
4 of 14 checks passed
@Sunrisepeak
Sunrisepeak deleted the fix/release-actions-read branch November 7, 2026 23:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant