ci(release): Stop requesting permissions from the reusable workflow

[tintinhamans]

Weekly Release was failing at startup because build-toolchain.yml
asked for packages: write but the callers never granted it
(secrets: inherit doesn't extend permissions).

Fixed by dropping the request from the reusable workflow and granting
contents: read (and packages: write for vcpkg presets) on the
caller jobs instead. Also dropped ci.yml's top-level
pull-requests: write, unused there. Added a comment since a missing
grant fails silently - vcpkg just stops using the NuGet cache instead
of erroring.

Tested on my fork, workflow runs clean now.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-09-11T20:54:46.938788Z	b42a5b9	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[qodo-free-for-open-source-projects]

PR Summary by Qodo

Move toolchain permissions to weekly release callers

🐞 Bug fix ⚙️ Configuration changes 🕐 Less than 10 minutes

AI Description

• Moves reusable toolchain permission ownership to weekly release build callers.
• Removes unnecessary secret inheritance and documents vcpkg cache permission requirements.
• Adds explicit read-only repository access to both weekly build jobs.

Diagram

graph TD
  A["Weekly Release"] -->|starts| B["Build Jobs"] -->|calls| C["Build Toolchain"] -->|uses cache| D["GHCR Cache"]

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Grant package access at workflow level

• ➕ Avoids duplicating permissions across reusable-workflow caller jobs
• ➕ Automatically covers future weekly toolchain callers
• ➖ Grants package-write access to unrelated jobs by default
• ➖ Provides broader privileges than necessary

Recommendation: Caller-owned job permissions are the correct least-privilege approach because a reusable workflow cannot elevate the caller token. However, the shown diff grants only contents: read; both build caller jobs must also declare packages: write for the stated GHCR cache fix to take effect.

Files changed (2) +5 / -6

Bug fix (1) +4 / -2

weekly-release.ymlScope weekly build caller permissions explicitly +4/-2

Scope weekly build caller permissions explicitly

• Adds job-level 'contents: read' permissions to both reusable toolchain callers. Removes unused 'secrets: inherit' declarations because the automatic GitHub token is controlled through permissions rather than inherited secrets.

.github/workflows/weekly-release.yml

Other (1) +1 / -4

build-toolchain.ymlDelegate reusable workflow permissions to callers +1/-4

Delegate reusable workflow permissions to callers

• Removes the workflow-level contents, pull-request, and package permissions. Adds a warning that callers must grant 'packages: write' or vcpkg silently stops using the GHCR cache.

.github/workflows/build-toolchain.yml

[qodo-free-for-open-source-projects]

Code Review by Qodo

🐞 Bugs (1) 📘 Rule violations (0) 📎 Requirement gaps (0) 🎨 UX issues (0) 🔗 Cross-repo conflicts (0) 📜 Skill insights (0)

1. Weekly cache writes remain unauthorized 🐞 Bug ≡ Correctness

Description

build-generals and build-generalsmd set only contents: read, so the reusable workflow's token
has no packages: write permission after its own permission block was removed. When either matrix
uses a preset containing vcpkg, build-toolchain.yml configures a read-write GitHub Packages
source and silently cannot upload the binary cache.

Code

.github/workflows/weekly-release.yml[R90-91]

+    permissions:
+      contents: read

Evidence

Both weekly callers explicitly limit their tokens to contents: read, while the reusable workflow
documents that callers must grant package writes and configures the GitHub Packages NuGet source as
readwrite for non-fork vcpkg builds. The regular CI workflow demonstrates the required caller-side
permission by granting packages: write before invoking the same reusable workflow.

.github/workflows/weekly-release.yml[86-126]
.github/workflows/build-toolchain.yml[3-6]
.github/workflows/build-toolchain.yml[38-43]
.github/workflows/build-toolchain.yml[116-136]
.github/workflows/ci.yml[3-6]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The weekly-release callers grant only `contents: read`, although the reusable build workflow requires `packages: write` when running a vcpkg preset. Without that grant, vcpkg silently skips binary-cache uploads.
## Fix Focus Areas
- .github/workflows/weekly-release.yml[90-91]
- .github/workflows/weekly-release.yml[111-112]
## Recommended Fix
Add `packages: write` to the `permissions` mapping for both `build-generals` and `build-generalsmd`, retaining `contents: read` for checkout access.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

Tip of the day

💡 Did you know, you can hide the parts of a finding you never read, like the evidence or the agent prompt

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[qodo-free-for-open-source-projects]

1. Weekly cache writes remain unauthorized 🐞 Bug ≡ Correctness

build-generals and build-generalsmd set only contents: read, so the reusable workflow's token
has no packages: write permission after its own permission block was removed. When either matrix
uses a preset containing vcpkg, build-toolchain.yml configures a read-write GitHub Packages
source and silently cannot upload the binary cache.

Agent Prompt

## Issue description
The weekly-release callers grant only `contents: read`, although the reusable build workflow requires `packages: write` when running a vcpkg preset. Without that grant, vcpkg silently skips binary-cache uploads.

## Fix Focus Areas
- .github/workflows/weekly-release.yml[90-91]
- .github/workflows/weekly-release.yml[111-112]

## Recommended Fix
Add `packages: write` to the `permissions` mapping for both `build-generals` and `build-generalsmd`, retaining `contents: read` for checkout access.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

[tintinhamans]

the reusable build workflow requires packages: write when running a vcpkg preset

And tell me my friend, where are the vcpkg presets in the weekly release?

[greptile-apps]

Greptile Summary

This PR narrows GitHub Actions permissions by moving package-write access from workflow scope to the reusable build jobs that use vcpkg.

• Removes ineffective permission declarations from the reusable toolchain workflow.
• Grants packages: write only to CI callers using vcpkg presets.
• Leaves VC6 CI and weekly-release callers with read-only repository access.
• Removes unnecessary inherited-secret access from weekly-release build jobs.

Confidence Score: 5/5

The pull request appears safe to merge; each build caller receives the permissions required by its selected preset without retaining unnecessary broader access.

The vcpkg callers retain packages: write, VC6 callers do not reach the package-cache steps, and no accepted new or outstanding previous findings remain.

Important Files Changed

Filename	Overview
.github/workflows/build-toolchain.yml	Removes reusable-workflow permission declarations so caller jobs explicitly determine the token permissions available to builds.
.github/workflows/ci.yml	Narrows default permissions and grants package-write access only to the two vcpkg build jobs.
.github/workflows/weekly-release.yml	Gives non-vcpkg reusable build jobs read-only access and removes unnecessary secret inheritance.

_{Reviews (2): Last reviewed commit: "ci(build-toolchain): stop requesting per..." | Re-trigger Greptile}

[xezon]

I do not understand this.

[bobtista]

Change looks good to me. Two nits on the wording:

The title says it grants packages: write in the callers, but the diff grants none, it removes the request from build-toolchain and gives the weekly jobs contents: read. Something like "ci(build-toolchain): Stop requesting permissions from the reusable workflow" would work.

And the new comment says GHCR, but the cache is the GitHub Packages NuGet feed, and "callers must grant packages: write" only holds for vcpkg presets. Maybe: "No permissions on purpose. Callers grant them per job: contents read for every preset, plus packages write for vcpkg presets or the NuGet binary cache is skipped with only a warning."

[bobtista]

Also, ci.yml's top-level pull-requests: write is now unused. Nothing in ci.yml uses it either. Could clean it up here or in a separate PR and move its packages: write onto the three vcpkg build jobs

[CryoTheRenegade]

Looks good, but pr title may be misleading

[tintinhamans]

Pushed the fixes for the two nits, and cleaned up the unused pull-requests: write in ci.yml too.

[Skyaero42]

Is there a way to run this the weekly release from this PR before merging? So we know it works?

[tintinhamans]

We cannot run it from this PR directly, but you can see this example on my fork: https://github.com/tintinhamans/GeneralsGameCode/actions/runs/34703775473