Repository navigation
ci(release): grant actions:write to the dylint call on the release path - #1754
Merged
Merged
Conversation
dylint.yml's merge-queue cache janitor (GEN-022) declares actions: write. release-auto -> ci-full -> dylint grants only contents: read, so every release-auto dispatch now fails with startup_failure (run 40425964410). Scope the extra permission to the two caller jobs.
|
Important Review skippedAuto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the
 |
zackees
added a commit
that referenced
this pull request
Oct 27, 2026
* fix(ci): move the dylint caller grant into the workflow SOT #1754 hand-edited the rendered .github/workflows/ci-full.yml, so the CI Workflow Drift job fails on main (`render_workflows.py --check`: ci-full.yml is out of sync with the SOT). Emit the `contents: read` + `actions: write` grant from ci/render_workflows.py instead, which regenerates the same file. Add a regression test that walks every `uses: ./.github/workflows/*.yml` edge and asserts the callee never requests more than the caller grants. GitHub enforces that at run startup, so the failure mode is the whole release run dying with no job ever starting (release-auto 40425964410). * test(ci): keep the permission guard inside the complexity ratchet The guard method hit C901 (12 > 10) in `ci/check_python_complexity.py`, which is what failed `linux / Check (ubuntu-latest)` on #1755. Move the walk into module-level helpers; the test method is now three lines.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Every
release-auto.ymldispatch fails withstartup_failure(run 40425964410, candidateecdba194for 2.5.46).Cause: #1749 / GEN-022 added
queue-cache-janitortodylint.ymlwithpermissions: actions: write.release-auto→ci-full→dylintgrants onlycontents: read, and a called workflow may not request more than its caller grants.Fix: grant
contents: read+actions: writeon the two caller jobs only:release-autofull-ciandci-fulldylint.Verified: a
release-autodry run dispatched from this branch (run 40426132784) starts with jobs, wheremainfails at startup.