[WRONG BRANCH] release: carry the release.yml permissions fix onto main for v2.40.0 by lidge-jun · Pull Request #3263 · lidge-jun/opencodex

lidge-jun · 2026-09-02T09:43:52Z

Summary

Cherry-pick of fix(release): pass the bump job's permissions through the reusable-workflow call #3262 (7ce0ba518) onto main: release.yml's bump-dev-version caller job now declares the contents: write + pull-requests: write that its reusable callee requires. Both v2.40.0 dispatches failed at startup without this; release.yml runs from the release branch, so the fix has to be on main itself.
One file, 8 added lines, no code.

Verification

tests/ci-workflows.test.ts 135 pass on dev; YAML parse confirms the job permissions.
After merge the v2.40.0 dispatch is re-run against the new main tip as expected-sha.

Checklist

Scope stays focused and avoids unrelated cleanup.
Docs or release notes were updated when needed (n/a).
Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults (fix(release): pass the bump job's permissions through the reusable-workflow call #3262).

Summary by CodeRabbit

Chores
- Updated release automation permissions to support writing repository contents and pull requests during development version updates.

…rkflow call (#3262) Both v2.40.0 release dispatches (33615174183 preview, 33615177849 main) died at startup_failure: a workflow_call cannot grant its callee more than the calling job holds, and dev-version-bump.yml's job declares contents+pull- requests write. #3129 wired the call but never dispatched a release, so this is its first live run. The caller job now declares exactly the callee's two permissions; no other job in release.yml gains anything. Co-authored-by: jun <jun@lidge.dev> (cherry picked from commit 7ce0ba5)

chatgpt-codex-connector · 2026-09-02T09:44:05Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-02T09:45:24.589089Z	`aaa9eaf`	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

lidge-jun · 2026-09-02T09:44:12Z

Owner admin merge, user-authorized; workflow-only cherry-pick of #3262.

github-actions · 2026-09-02T09:44:30Z

✅ Deterministic PR hygiene checks passed.

github-actions · 2026-09-02T09:44:53Z

⏳ DRAFT

wrong target branch (main); retarget to dev.

What to do

Retarget this PR to dev — all contributions go to dev.

Its title has been prefixed with [WRONG BRANCH].
Automatic draft conversion failed (token cannot change draft status). Please convert this pull request to a draft manually. The required enforce-target check will keep failing until every issue above is resolved.

coderabbitai · 2026-09-02T09:44:56Z

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Team

Run ID: 7086eaf8-83c3-4cad-bf13-af8af85ecf04

📥 Commits

Reviewing files that changed from the base of the PR and between ac78647 and aaa9eaf.

📒 Files selected for processing (1)

.github/workflows/release.yml

📝 Walkthrough

Walkthrough

The release workflow now grants dev-version-bump.yml permission to write repository contents and pull requests.

Changes

Release workflow permissions

Layer / File(s)	Summary
Configure version-bump permissions `.github/workflows/release.yml`	Lines 70–77 grant `contents: write` and `pull-requests: write` to the reusable `dev-version-bump.yml` workflow.

Estimated code review effort: 2 (Simple) | ~5 minutes

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch codex/promote-main-2400-relfix

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

lidge-jun · 2026-09-02T10:32:01Z

리뷰 · 우선순위 71 / 80

이 PR은 #3262(7ce0ba518) 를 main 위에 cherry-pick 한 릴리즈 수리이다. 제목에 [WRONG BRANCH] 가 붙어 있지만, release.yml 은 릴리즈 가지에서 실행되므로 권한 수정이 main 자체에 있어야 v2.40.0 디스패치가 시동한다. 파일 하나·8줄. 제품 코드 없음.

배경 한 줄. #3261 로 dev(a6ee24f5b) 가 main 에 올라간 직후, 첫 v2.40.0 디스패치가 bump-dev-version 권한 상속 때문에 startup_failure 로 죽었다. #3262 는 dev 쪽을 고쳤고, 이 PR이 그 수정을 안정 채널에 실었다. merge tip은 35ff3a462 이고 태그 v2.40.0 이 그 위를 가리킨다.

리뷰 시점 origin/dev 는 272ff6b11 이다. dev 에는 이미 #3262 본문이 있고, 이 PR은 main 전용 운반이다. 미리보기 쪽 쌍둥이는 #3264 다. ALLOWED_BASES=["dev"] 때문에 enforce-target 빨강·[WRONG BRANCH] 는 설계상 정상이다. 베이스를 dev 로 바꾸면 채널 수리가 아니다.

경로 base main / cherry-pick #3262 - 호출 잡 permissions 8줄만 옮긴다. 새 기능 없음.
경로 GitHub Actions / enforce-target - 승격·채널 수리 PR의 알려진 빨강. 무시하고 admin merge 한 선택이 맞다.
경로 태그 v2.40.0 - 이 tip 위에서 퍼블리시 완료. 재머지 불필요.
경로 현재 dev - 이미 같은 권한 블록을 갖고 있다. 이 PR을 dev 로 재겨냥하지 마라.

메인테이너의 판단이 필요한 지점

(사후) 채널 cherry-pick(#3263/#3264)을 릴리즈 체크리스트에 고정할지
권한 상속 검사를 CI 테스트로 고정할지

너의 추천
이미 머지·태그·퍼블리시가 끝났으니 추가 작업 없다. 다음 안정 릴리즈에서도 dev 수리 후 main/preview 에 같은 워크플로 줄을 바로 옮기는 순서를 유지하면 된다.

이 댓글은 grok-bot이 작성했습니다

…toggle (#3269) * devlog(release): 080 — bot PR toggle provenance and decision, service-lifecycle trigger gap * chore(devlog): wp1 provenance closeout marker * devlog(release): 080 — toggle applied via REST, read-back true * ci(service-lifecycle): trigger on release.yml changes so the release gate cannot dead-end release.yml requires a service-lifecycle run for the release SHA when any gated path changed since the previous tag, but a release-branch commit that touched only release.yml (the v2.40.0 permissions carry, #3263/#3264) matched no lifecycle trigger path, so both dispatches needed a manual run. The path is now in both trigger lists and the gate regex; tests/ci-workflows keeps the three in sync. --------- Co-authored-by: jun <jun@lidge.dev>

lidge-jun requested a review from Ingwannu as a code owner September 2, 2026 09:43

github-actions Bot added the bug Something isn't working label Sep 2, 2026

lidge-jun merged commit 35ff3a4 into main Sep 2, 2026
21 of 23 checks passed

lidge-jun deleted the codex/promote-main-2400-relfix branch September 2, 2026 09:44

github-actions Bot changed the title ~~release: carry the release.yml permissions fix onto main for v2.40.0~~ [WRONG BRANCH] release: carry the release.yml permissions fix onto main for v2.40.0 Sep 2, 2026

lidge-jun mentioned this pull request Sep 2, 2026

ci(service-lifecycle): trigger on release.yml; devlog for the bot-PR toggle #3269

Merged

3 tasks

Navigation Menu

[WRONG BRANCH] release: carry the release.yml permissions fix onto main for v2.40.0 - #3263

[WRONG BRANCH] release: carry the release.yml permissions fix onto main for v2.40.0#3263
lidge-jun merged 1 commit into
mainfrom
codex/promote-main-2400-relfix

lidge-jun commented Sep 2, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

chatgpt-codex-connector Bot commented Sep 2, 2026 •

edited

Loading

Uh oh!

lidge-jun commented Sep 2, 2026

Uh oh!

Uh oh!

github-actions Bot commented Sep 2, 2026

Uh oh!

github-actions Bot commented Sep 2, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Sep 2, 2026 •

edited

Loading

Review failed

Walkthrough

Changes

Uh oh!

lidge-jun commented Sep 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

lidge-jun commented Sep 2, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Verification

Checklist

Summary by CodeRabbit

Uh oh!

chatgpt-codex-connector Bot commented Sep 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

lidge-jun commented Sep 2, 2026

Uh oh!

Uh oh!

github-actions Bot commented Sep 2, 2026

Uh oh!

github-actions Bot commented Sep 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⏳ DRAFT

What to do

Uh oh!

coderabbitai Bot commented Sep 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review failed

Walkthrough

Changes

Uh oh!

lidge-jun commented Sep 2, 2026

리뷰 · 우선순위 71 / 80

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

lidge-jun commented Sep 2, 2026 •

edited by coderabbitai Bot

Loading

chatgpt-codex-connector Bot commented Sep 2, 2026 •

edited

Loading

github-actions Bot commented Sep 2, 2026 •

edited

Loading

coderabbitai Bot commented Sep 2, 2026 •

edited

Loading