ci: fix BCR publish job startup_failure (drop job-level permissions) - #17
Merged
Merged
Conversation
The release workflow failed at startup_failure with the `publish` job carrying a job-level `permissions:` block while calling the local reusable `publish.yaml`. Match the proven bazel-contrib/rules_lint pattern (no per-job permissions on the publish call); publish-to-bcr uses the BCR_PUBLISH_TOKEN PAT for the fork push + PR.
helly25
enabled auto-merge (squash)
June 14, 2026 16:04
Fab-Cat
approved these changes
Jun 14, 2026
helly25
added a commit
that referenced
this pull request
Jun 14, 2026
The 0.3.1 release startup-failed: a called reusable workflow cannot exceed the caller's permissions, and the two sides didn't line up. - release.yml publish job: grant `contents: write` (PR #17 wrongly removed it, leaving the default `contents: read`, which rejected publish.yaml's `contents: write` job). - publish.yaml: drop top-level `permissions: read-all`; as a reusable workflow it forced the caller to grant every read scope (which a write-only grant doesn't include). Match the rules_lint pattern where the wrapper requests only its job's scopes. Net: caller grants `contents: write`, publish.yaml requests exactly `contents: write` -> valid. (Proven sufficient: the standalone dispatch ran publish-to-bcr with contents:write on the job.)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The
0.3.1release run hitstartup_failure(no jobs ran). Isolated to thepublishjob in release.yml: the standalonepublish.yamldispatch validated and ran (authenticated with the PAT, cloned the BCR fork), so the publish chain is sound. The only structural delta from the proven rules_lint pattern was a job-levelpermissions:block on the publish job. Removing it to match. Re-cut 0.3.1 after merge.