fix: grant release-ready contents write permission

[neubig]

Summary

• grant the release ready reusable workflow contents: write
• retain the existing actions, issues, and pull-requests permissions

Why

The shared OpenHands/release-actions/.github/workflows/release-ready.yml@main workflow declares nested jobs that require contents: write. GitHub validates reusable-workflow permissions at startup, including jobs that may later be skipped by an if condition, so this caller cannot grant only contents: read.

All 55 Agent Canvas release ready runs observed from July 9 through July 26 failed during workflow startup for this reason; ordinary CI still ran because this workflow is not a required check.

Examples:

• earliest observed failure: https://github.com/OpenHands/agent-canvas/actions/runs/29014712152
• latest observed failure: https://github.com/OpenHands/agent-canvas/actions/runs/30197694434

Validation

• git diff --check
• workflow change matches the OpenHands caller fix whose full CI passed in fix(ci): grant release workflow content write access OpenHands#15399

Tracks OpenHands/OpenHands#15396.

---

🐳 Docker images for this PR

• GHCR package: https://github.com/OpenHands/agent-canvas/pkgs/container/agent-canvas

Component	Value
Image	ghcr.io/openhands/agent-canvas
Architectures	amd64, arm64
Agent Server	ghcr.io/openhands/agent-server:1.37.0-python
Automation	openhands-automation==1.3.1
Commit	4144b12a344cef6e7d265adf4d82abe9ff5cbfff

Pull (multi-arch manifest)

# Multi-arch manifest — Docker automatically pulls the correct architecture
docker pull ghcr.io/openhands/agent-canvas:sha-4144b12

Run

docker run -it --rm \
  -p 8000:8000 \
  ghcr.io/openhands/agent-canvas:sha-4144b12

All tags pushed for this build

ghcr.io/openhands/agent-canvas:sha-4144b12-amd64
ghcr.io/openhands/agent-canvas:agent-fix-release-ready-permissions-canvas-amd64
ghcr.io/openhands/agent-canvas:pr-1954-amd64
ghcr.io/openhands/agent-canvas:sha-4144b12-arm64
ghcr.io/openhands/agent-canvas:agent-fix-release-ready-permissions-canvas-arm64
ghcr.io/openhands/agent-canvas:pr-1954-arm64
ghcr.io/openhands/agent-canvas:sha-4144b12
ghcr.io/openhands/agent-canvas:agent-fix-release-ready-permissions-canvas
ghcr.io/openhands/agent-canvas:pr-1954

About Multi-Architecture Support

• Each tag (e.g., sha-4144b12) is a multi-arch manifest supporting both amd64 and arm64
• Docker automatically pulls the correct architecture for your platform
• Individual architecture tags (e.g., sha-4144b12-amd64) are also available if needed

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
agent-canvas	Ready	Preview, Comment	Jul 27, 2026 11:37am

[neubig]

This repository has moved to https://github.com/OpenHands/OpenHands. We’d appreciate it if you re-opened this pull request there. Thank you!