Grant packages read permission to JAX release workflow

[erman-gurses]

Summary

Grant packages: read permission to the RockRel multi-arch JAX release workflow.

The reusable workflow invoked from ROCm/TheRock requests packages: read, but the caller workflow did not grant that permission. GitHub Actions rejects the workflow invocation with:

Error: https://github.com/ROCm/rockrel/actions/runs/27806016125

The nested job 'build_jax_wheels' is requesting 'packages: read', but is only allowed 'packages: none'

Changes

• Add packages: read to the top-level workflow permissions in:

  • .github/workflows/multi_arch_release_linux_jax_wheels.yml

[marbre]

This is correct on the surface and will resolve the issue but might not be the correct fix. Taking a quick look at https://github.com/ROCm/TheRock/blob/main/.github/workflows/multi_arch_build_linux_jax_wheels.yml, I couldn't spot why packages: read should be needed. Please take a closer look at the underlying permissions and if we can drop package: read from the called workflow instead.

[erman-gurses]

Please take a closer look at the underlying permissions and if we can drop package: read from the called workflow instead.

Thanks — I took a closer look. build_jax_wheels itself does not require packages: read. The permission is needed by the nested test workflow (.github/workflows/test_linux_jax_wheels_partial.yml), which runs inside the ghcr.io/rocm/no_rocm_image_ubuntu24_04 container.

I tried removing all packages: read from the build workflows,

multi_arch_release_linux_jax_wheels.yml
multi_arch_build_linux_jax_wheels.yml

but GitHub workflow validation fails when test_linux_jax_wheels_partial.yml is invoked:

[Invalid workflow file: .github/workflows/multi_arch_release_linux_jax_wheels.yml#L227](https://github.com/ROCm/rockrel/actions/runs/27815873177/workflow)
The workflow is not valid. ROCm/TheRock/.github/workflows/multi_arch_build_linux_jax_wheels.yml@baea60d97639126e5259aecbaf10a55ae60e0851 (Line: 227, Col: 3): Error calling workflow 'ROCm/TheRock/.github/workflows/test_linux_jax_wheels_partial.yml@baea60d97639126e5259aecbaf10a55ae60e0851'. The workflow is requesting 'packages: read', but is only allowed 'packages: none'.

So packages: read is not needed by the build job itself, but it is still required in the workflow call chain because the nested test workflow requests it. I kept it where it is needed for the test workflow.

[erman-gurses]

Please take a closer look at the underlying permissions and if we can drop package: read from the called workflow instead.

Thanks — I took a closer look. build_jax_wheels itself does not require packages: read. The permission is needed by the nested test workflow (.github/workflows/test_linux_jax_wheels_partial.yml), which runs inside the ghcr.io/rocm/no_rocm_image_ubuntu24_04 container.

I tried removing packages: read from the build workflows,

multi_arch_release_linux_jax_wheels.yml
multi_arch_build_linux_jax_wheels.yml

but GitHub workflow validation fails when test_linux_jax_wheels_partial.yml is invoked:

[Invalid workflow file: .github/workflows/multi_arch_release_linux_jax_wheels.yml#L227](https://github.com/ROCm/rockrel/actions/runs/27815873177/workflow)
The workflow is not valid. ROCm/TheRock/.github/workflows/multi_arch_build_linux_jax_wheels.yml@baea60d97639126e5259aecbaf10a55ae60e0851 (Line: 227, Col: 3): Error calling workflow 'ROCm/TheRock/.github/workflows/test_linux_jax_wheels_partial.yml@baea60d97639126e5259aecbaf10a55ae60e0851'. The workflow is requesting 'packages: read', but is only allowed 'packages: none'.

So packages: read is not needed by the build job itself, but it is still required in the workflow call chain because the nested test workflow requests it. I kept it where it is needed for the test workflow.

One clarification:

When I added packages: read to rockrel side
It is worked by removing only this one which you spotted: https://github.com/ROCm/TheRock/blob/main/.github/workflows/multi_arch_build_linux_jax_wheels.yml#L112

But I need to keep this one since I got error below when I removed both of them: https://github.com/ROCm/TheRock/blob/main/.github/workflows/multi_arch_release_linux_jax_wheels.yml#L89

[Invalid workflow file: .github/workflows/multi_arch_release_linux_jax_wheels.yml#L74](https://github.com/ROCm/rockrel/actions/runs/27818330695/workflow)
The workflow is not valid. ROCm/TheRock/.github/workflows/multi_arch_release_linux_jax_wheels.yml@users/erman-gurses/fix-jax-target-run-checkout (Line: 74, Col: 3): Error calling workflow 'ROCm/TheRock/.github/workflows/multi_arch_build_linux_jax_wheels.yml@62670cda9c77aabddc8a497fd0858df665375163'. The nested job 'test_jax_wheels' is requesting 'packages: read', but is only allowed 'packages: none'.

[marbre]

The ask was not to only drop it from the build job only as this moves the problem but doesn't resolves it. So your agent did a bad job here:

Thanks — I took a closer look. build_jax_wheels itself does not require packages: read. The permission is needed by the nested test workflow (.github/workflows/test_linux_jax_wheels_partial.yml), which runs inside the ghcr.io/rocm/no_rocm_image_ubuntu24_04 container.

We actually only require use packages permissions in the following jobs:

multi_arch_build_linux_jax_wheels.yml:  packages: read
multi_arch_build_linux_jax_wheels.yml:      packages: read
multi_arch_release_linux_jax_wheels.yml:      packages: read
publish_build_manylinux_x86_64.yml:  packages: write
publish_dockerfile.yml:      packages: write
publish_no_rocm_image_ubi10.yml:  packages: write
publish_no_rocm_image_ubuntu24_04.yml:  packages: write
publish_no_rocm_image_ubuntu24_04_ocl_rt.yml:  packages: write
publish_no_rocm_image_ubuntu24_04_rocgdb.yml:  packages: write
test_linux_jax_wheels.yml:  packages: read
test_linux_jax_wheels_partial.yml:  packages: read

So I am under the impression we can drop every packages: read. Only packages: write in the publish jobs should be needed but our images are public.

[erman-gurses]

The ask was not to only drop it from the build job only as this moves the problem but doesn't resolves it. So your agent did a bad job here:

Thanks — I took a closer look. build_jax_wheels itself does not require packages: read. The permission is needed by the nested test workflow (.github/workflows/test_linux_jax_wheels_partial.yml), which runs inside the ghcr.io/rocm/no_rocm_image_ubuntu24_04 container.

We actually only require packages permissions in the following jobs:

That is my simple reasoning from the tests, not agent :)

I can test that too but do not we have packages: read for container reading? Let me test and share the results.

[erman-gurses]

The ask was not to only drop it from the build job only as this moves the problem but doesn't resolves it. So your agent did a bad job here:

Thanks — I took a closer look. build_jax_wheels itself does not require packages: read. The permission is needed by the nested test workflow (.github/workflows/test_linux_jax_wheels_partial.yml), which runs inside the ghcr.io/rocm/no_rocm_image_ubuntu24_04 container.

We actually only require packages permissions in the following jobs:

That is my simple reasoning from the tests, not agent :)

I can test that too but do not we have packages: read for container reading? Let me test and share the results.

That is nice, it does not complain: https://github.com/ROCm/rockrel/actions/runs/27820440429/job/82331986576

I was interpreting packages: read differently - it is more like authentication not reading it.

Will raise a PR on TheRock side. I will close this after the tests are done.

[marbre]

The ask was not to only drop it from the build job only as this moves the problem but doesn't resolves it. So your agent did a bad job here:

Thanks — I took a closer look. build_jax_wheels itself does not require packages: read. The permission is needed by the nested test workflow (.github/workflows/test_linux_jax_wheels_partial.yml), which runs inside the ghcr.io/rocm/no_rocm_image_ubuntu24_04 container.

We actually only require packages permissions in the following jobs:

The above was missframed. We only have/use the permissions in the listed jobs.

That is my simple reasoning from the tests, not agent :)

Where do you have an emdash on your keyboard? :D

I can test that too but do not we have packages: read for container reading? Let me test and share the results.

We do not use it in any of the non-JAX jobs but we use manylinux for every build. And those job don't have packages: read. Therefore my guess to just drop it. Might be that contents: read is covering or that this is fine anyway as it isn't a private registry.

Will raise a PR on TheRock side. I will close this after the tests are done.

Sounds good! Feel free to request a review from me.

[erman-gurses]

Thank Marius! That helped a lot - You do not believe me :) but It was my idea, I was discussing with my agent - it was opposing to me actually. It just reframed my thoughts. Thanks again.

[marbre]

Thank Marius! That helped a lot - You do not believe me :) but It was my idea, I was discussing with my agent - it was opposing to me actually. It just reframed my thoughts. Thanks again.

Oh, I was only saying an agent was involved ;) Happed the feedback helped.