From 84a82e6526567dea1309d551e17015c5f18c3385 Mon Sep 17 00:00:00 2001
From: Zach Vorhies <zachvorhies@protonmail.com>
Date: Mon, 26 Oct 2026 17:23:50 -0700
Subject: [PATCH] ci(release): grant actions:write to the dylint call on the
 release path

dylint.yml's merge-queue cache janitor (GEN-022) declares actions: write.
release-auto -> ci-full -> dylint grants only contents: read, so every
release-auto dispatch now fails with startup_failure (run 40425964410).
Scope the extra permission to the two caller jobs.
---
 .github/workflows/ci-full.yml      | 4 ++++
 .github/workflows/release-auto.yml | 6 ++++++
 2 files changed, 10 insertions(+)

diff --git a/.github/workflows/ci-full.yml b/.github/workflows/ci-full.yml
index ac6872be6..7a42fa6ec 100644
--- a/.github/workflows/ci-full.yml
+++ b/.github/workflows/ci-full.yml
@@ -74,6 +74,10 @@ jobs:
   dylint:
     if: github.event_name != 'pull_request' || contains(github.event.pull_request.labels.*.name, 'ci-full')
     needs: verify
+    # The merge-queue cache janitor in dylint.yml declares `actions: write`.
+    permissions:
+      contents: read
+      actions: write
     uses: ./.github/workflows/dylint.yml
     with:
       ref: ${{ needs.verify.outputs.candidate_sha }}
diff --git a/.github/workflows/release-auto.yml b/.github/workflows/release-auto.yml
index ba3298e50..5615004a9 100644
--- a/.github/workflows/release-auto.yml
+++ b/.github/workflows/release-auto.yml
@@ -263,6 +263,12 @@ jobs:
     name: Full validation on release commit
     needs: prepare
     if: needs.prepare.outputs.should_build == 'true'
+    # dylint.yml's merge-queue cache janitor declares `actions: write`; a
+    # called workflow may not request more than its caller grants, or the
+    # whole release run fails at startup.
+    permissions:
+      contents: read
+      actions: write
     uses: ./.github/workflows/ci-full.yml
     with:
       candidate_sha: ${{ needs.prepare.outputs.release_ref }}