fix: grant full union of permissions for nested release jobs#212
Merged
Conversation
## What Expand the `release` job's `permissions:` block to grant `id-token: write`, `attestations: write`, `packages: write`, and `discussions: write` in addition to the existing two. The block now covers the union of permissions declared by every job in the called `ospo-reusable-workflows/release.yaml@v1.0.1`. ## Why The merge of #211 left main on the consolidated workflow with only `contents: write` + `pull-requests: read`. The `pull_request_target: closed` Release run that fired on merge failed with `startup_failure`: "The nested job 'release_image' is requesting 'attestations: write, packages: write, id-token: write', but is only allowed ...". GitHub validates each nested job's `permissions:` against the caller's grant at workflow startup, **before** evaluating that job's `if:` — except when the gate folds statically to `false`. The gates on `release_goreleaser` (`inputs.goreleaser-config-path != ''`) and `release_image` (`inputs.image-name != ''`) are string comparisons the validator can't fold, so their perms are checked even though both jobs would have been skipped at runtime here (this repo sets neither input). ## Notes - `release_discussion`'s gate (`inputs.create-discussion && ...`) DOES fold statically (boolean default `false`), so the validator skips it today and `discussions: write` is not technically required. Granting it anyway as a defensive measure in case the upstream rearranges that `if:` later. - This PR carries the `release` label so the now-fixed workflow fires on merge and cuts the release that #211 never produced. Worth confirming the `Release` run on the merge commit completes (create_release + publish_release succeed, release_goreleaser / release_image / release_discussion skipped). Signed-off-by: jmeridth <jmeridth@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Expand the
releasejob'spermissions:block to grantid-token: write,attestations: write,packages: write, anddiscussions: writein addition to the existing two. The block now covers the union of permissions declared by every job in the calledospo-reusable-workflows/release.yaml@v1.0.1.Why
The merge of #211 left main on the consolidated workflow with only
contents: write+pull-requests: read. Thepull_request_target: closedRelease run that fired on merge failed withstartup_failure:GitHub validates each nested job's
permissions:against the caller's grant at workflow startup, before evaluating that job'sif:— except when the gate folds statically tofalse. The gates onrelease_goreleaser(inputs.goreleaser-config-path != '') andrelease_image(inputs.image-name != '') are string comparisons the validator can't fold, so their perms are checked even though both jobs would have been skipped at runtime here (this repo sets neither input).Notes
release_discussion's gate (inputs.create-discussion && ...) DOES fold statically (boolean defaultfalse), so the validator skips it today anddiscussions: writeis not technically required. Granted anyway as a defensive measure in case the upstream rearranges thatif:later — it costs nothing today and prevents a future silent regression.releaselabel so the now-fixed workflow fires on merge and cuts the release that ci: adopt consolidated ospo-reusable-workflows release.yaml #211 never produced.create_release+publish_releaseshould succeed, andrelease_goreleaser/release_image/release_discussionshould appear as skipped.Testing
make test— passes (command, config, internal/install, internal/manifest, internal/registry, pluginkit, utils all green).golangci-lint run ./...— 0 issues.pull_request_targetchain.