Skip to content

ci(runway-ota): add actions: read permission for slack notification cp-7.79.1 cp-7.80.0#30973

Merged
tommasini merged 1 commit into
mainfrom
fix/runway-ota-build-permissions
Jun 2, 2026
Merged

ci(runway-ota): add actions: read permission for slack notification cp-7.79.1 cp-7.80.0#30973
tommasini merged 1 commit into
mainfrom
fix/runway-ota-build-permissions

Conversation

@tommasini

@tommasini tommasini commented Jun 2, 2026

Copy link
Copy Markdown
Contributor

Description

The runway-ota-rc.yml caller workflow was missing the actions: read permission required by the slack-rc-notification.yml reusable workflow.

GitHub Actions enforces that a reusable workflow cannot use permissions that the calling workflow has not already granted. slack-rc-notification.yml declares actions: read (needed by actions/download-artifact@v4 to download the Android Play Store check report), but runway-ota-rc.yml only granted contents: read, pull-requests: read, and id-token: write. This caused the workflow validation step to fail with:

Error calling workflow '…slack-rc-notification.yml…'. The workflow is requesting 'actions: read', but is only allowed 'actions: none'.

The fix adds actions: read to the permissions block in runway-ota-rc.yml.

Changelog

CHANGELOG entry: null

Related issues

Fixes:

Manual testing steps

N/A

Screenshots/Recordings

Before

N/A

After

N/A

Pre-merge author checklist

Performance checks (if applicable)

  • I've tested on Android
    • Ideally on a mid-range device; emulator is acceptable
  • I've tested with a power user scenario
    • Use these power-user SRPs to import wallets with many accounts and tokens
  • I've instrumented key operations with Sentry traces for production performance metrics

For performance guidelines and tooling, see the Performance Guide.

Pre-merge reviewer checklist

  • I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed).
  • I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.

Made with Cursor


Note

Low Risk
Single CI permission line; no app, auth, or release logic changes.

Overview
Grants actions: read on the Runway OTA RC caller workflow so it can invoke slack-rc-notification.yml without GitHub rejecting the run.

Reusable workflows only get permissions the caller explicitly allows; the Slack workflow needs actions: read for actions/download-artifact@v4 (Android Play Store check report). Without this line, validation fails with actions: none vs actions: read.

Reviewed by Cursor Bugbot for commit d8d24e7. Bugbot is set up for automated code reviews on this repo. Configure here.

@tommasini tommasini self-assigned this Jun 2, 2026
@github-actions

github-actions Bot commented Jun 2, 2026

Copy link
Copy Markdown
Contributor

CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes.

@mm-token-exchange-service mm-token-exchange-service Bot added the team-mobile-platform Mobile Platform team label Jun 2, 2026
@github-project-automation github-project-automation Bot moved this to Needs dev review in PR review queue Jun 2, 2026
@tommasini tommasini marked this pull request as ready for review June 2, 2026 22:01
@tommasini tommasini requested a review from a team as a code owner June 2, 2026 22:01
@tommasini tommasini changed the title ci(runway-ota): add actions: read permission for slack notification ci(runway-ota): add actions: read permission for slack notification cp-7.79.1 cp-7.80.0 Jun 2, 2026

@Cal-L Cal-L left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@github-project-automation github-project-automation Bot moved this from Needs dev review to Review finalised - Ready to be merged in PR review queue Jun 2, 2026
@tommasini tommasini enabled auto-merge June 2, 2026 22:09
@tommasini tommasini added this pull request to the merge queue Jun 2, 2026
Merged via the queue into main with commit 1e488e3 Jun 2, 2026
149 of 171 checks passed
@tommasini tommasini deleted the fix/runway-ota-build-permissions branch June 2, 2026 22:43
@github-actions github-actions Bot locked and limited conversation to collaborators Jun 2, 2026
@metamaskbotv2 metamaskbotv2 Bot added the release-7.81.0 Issue or pull request that will be included in release 7.81.0 label Jun 2, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

release-7.81.0 Issue or pull request that will be included in release 7.81.0 size-XS team-mobile-platform Mobile Platform team

Projects

Archived in project

Development

Successfully merging this pull request may close these issues.

3 participants