From 6d31bdfa59d629a3815973c1aa47bb50c524cad2 Mon Sep 17 00:00:00 2001 From: Philip Hartlieb Date: Mon, 26 Oct 2026 15:07:46 -0400 Subject: [PATCH] fix(cla): stop requiring contents: read in the reusable CLA job A called workflow can't get more than its caller grants. Since de827267 (2026-10-06) the job asks for contents: read, so callers that don't grant it fail at startup: bbot has on every CLA run since then. pull_request_target runs the default branch's caller, so bbot can't fix this from dev. The job's GITHUB_TOKEN only comments and sets statuses; the signatures are read with the App token. --- .github/workflows/cla-reusable.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/.github/workflows/cla-reusable.yml b/.github/workflows/cla-reusable.yml index 7257634..e11f540 100644 --- a/.github/workflows/cla-reusable.yml +++ b/.github/workflows/cla-reusable.yml @@ -9,7 +9,6 @@ jobs: permissions: pull-requests: write statuses: write - contents: read runs-on: ubuntu-24.04 steps: - name: Generate token from GitHub App