Repository navigation
fix(cla): stop requiring contents: read in the reusable CLA job (main) - #13
Merged
Merged
Conversation
A called workflow can't get more than its caller grants. Since de82726 (2026-10-06) the job asks for contents: read, so callers that don't grant it fail at startup: bbot has on every CLA run since then. pull_request_target runs the default branch's caller, so bbot can't fix this from dev. The job's GITHUB_TOKEN only comments and sets statuses; the signatures are read with the App token.
liquidsec
approved these changes
Oct 27, 2026
en0f
approved these changes
Oct 27, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Every CLA run on bbot has failed at startup since 2026-10-06. de82726 made the reusable job ask for
contents: read, and a called workflow can't get more than its caller grants. bbot's caller onstabledoesn't grant it, andpull_request_targetruns the default branch's caller, so bbot can't fix this fromdev(bbot#3570 changeddevonly).This removes
contents: readfrom the job. ItsGITHUB_TOKENonly comments and sets statuses; signatures are read with the App token. CLA worked without it until 10-06.Verify after merge: the next bbot CLA run is not
startup_failure(gh run list -R blacklanternsecurity/bbot -w cla.yml -L 3).CLA#11 also edits this file (action pin only); one of the two will need a rebase.