Skip to content

ci(release): Stop requesting permissions from the reusable workflow #3276

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
xezon merged 1 commit into from
Sep 12, 2026
+13 −8
Merged

ci(release): Stop requesting permissions from the reusable workflow #3276

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 1 addition & 4 deletions .github/workflows/build-toolchain.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,9 +1,6 @@
name: Build Toolchain

permissions:
contents: read
pull-requests: write
packages: write
# No permissions here - callers grant contents: read, and packages: write if using vcpkg.

on:
workflow_call:
Expand Down
10 changes: 8 additions & 2 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,8 +2,6 @@ name: GenCI

permissions:
contents: read
pull-requests: write
packages: write

on:
push:
Expand Down Expand Up @@ -61,6 +59,9 @@ jobs:
name: Build Generals${{ matrix.preset && '' }}
needs: detect-changes
if: ${{ github.event_name == 'workflow_dispatch' || needs.detect-changes.outputs.generals == 'true' || needs.detect-changes.outputs.shared == 'true' }}
permissions:
contents: read
packages: write
strategy:
matrix:
include:
Expand Down Expand Up @@ -106,6 +107,8 @@ jobs:
name: Build GeneralsMD${{ matrix.preset && '' }}
needs: detect-changes
if: ${{ github.event_name == 'workflow_dispatch' || needs.detect-changes.outputs.generalsmd == 'true' || needs.detect-changes.outputs.shared == 'true' }}
permissions:
contents: read
strategy:
matrix:
include:
Expand Down Expand Up @@ -134,6 +137,9 @@ jobs:
name: Build GeneralsMD${{ matrix.preset && '' }}
needs: detect-changes
if: ${{ github.event_name == 'workflow_dispatch' || needs.detect-changes.outputs.generalsmd == 'true' || needs.detect-changes.outputs.shared == 'true' }}
permissions:
contents: read
packages: write
strategy:
matrix:
include:
Expand Down
6 changes: 4 additions & 2 deletions .github/workflows/weekly-release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -87,6 +87,8 @@ jobs:
needs: [detect-scm-changes, get-date]
if: needs.detect-scm-changes.outputs.changed == 'true'
name: Build Generals${{ matrix.preset && '' }}
permissions:
contents: read
Comment on lines +90 to +91

@qodo-free-for-open-source-projects qodo-free-for-open-source-projects Bot Sep 11, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Remediation recommended

1. Weekly cache writes remain unauthorized 🐞 Bug ≡ Correctness

build-generals and build-generalsmd set only contents: read, so the reusable workflow's token
has no packages: write permission after its own permission block was removed. When either matrix
uses a preset containing vcpkg, build-toolchain.yml configures a read-write GitHub Packages
source and silently cannot upload the binary cache.
Agent Prompt 
## Issue description
The weekly-release callers grant only `contents: read`, although the reusable build workflow requires `packages: write` when running a vcpkg preset. Without that grant, vcpkg silently skips binary-cache uploads.

## Fix Focus Areas
- .github/workflows/weekly-release.yml[90-91]
- .github/workflows/weekly-release.yml[111-112]

## Recommended Fix
Add `packages: write` to the `permissions` mapping for both `build-generals` and `build-generalsmd`, retaining `contents: read` for checkout access.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

@tintinhamans tintinhamans Sep 11, 2026

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

the reusable build workflow requires packages: write when running a vcpkg preset

And tell me my friend, where are the vcpkg presets in the weekly release?

strategy:
matrix:
include:
Expand All @@ -101,12 +103,13 @@ jobs:
preset: ${{ matrix.preset }}
tools: ${{ matrix.tools }}
extras: ${{ matrix.extras }}
secrets: inherit

build-generalsmd:
needs: [detect-scm-changes, get-date]
if: needs.detect-scm-changes.outputs.changed == 'true'
name: Build GeneralsMD${{ matrix.preset && '' }}
permissions:
contents: read
strategy:
matrix:
include:
Expand All @@ -121,7 +124,6 @@ jobs:
preset: ${{ matrix.preset }}
tools: ${{ matrix.tools }}
extras: ${{ matrix.extras }}
secrets: inherit

create-release:
name: Create Release
Expand Down