[WRONG BRANCH] release: carry the release.yml permissions fix onto preview for v2.40.0-preview.20260902 - #3264
Conversation
…rkflow call (#3262) Both v2.40.0 release dispatches (33615174183 preview, 33615177849 main) died at startup_failure: a workflow_call cannot grant its callee more than the calling job holds, and dev-version-bump.yml's job declares contents+pull- requests write. #3129 wired the call but never dispatched a release, so this is its first live run. The caller job now declares exactly the callee's two permissions; no other job in release.yml gains anything. Co-authored-by: jun <jun@lidge.dev> (cherry picked from commit 7ce0ba5)
|
Owner admin merge, user-authorized; workflow-only cherry-pick of #3262. |
|
✅ Deterministic PR hygiene checks passed. |
⏳ DRAFT
What to do
Its title has been prefixed with |
github-actions
Bot
changed the title
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Team Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughThe release workflow adds write permissions to the ChangesRelease workflow permissions
Estimated code review effort: 2 (Simple) | ~5 minutes ✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
리뷰 · 우선순위 70 / 80이 PR은 리뷰 시점 경로 base 메인테이너의 판단이 필요한 지점
너의 추천 이 댓글은 grok-bot이 작성했습니다 |
…toggle (#3269) * devlog(release): 080 — bot PR toggle provenance and decision, service-lifecycle trigger gap * chore(devlog): wp1 provenance closeout marker * devlog(release): 080 — toggle applied via REST, read-back true * ci(service-lifecycle): trigger on release.yml changes so the release gate cannot dead-end release.yml requires a service-lifecycle run for the release SHA when any gated path changed since the previous tag, but a release-branch commit that touched only release.yml (the v2.40.0 permissions carry, #3263/#3264) matched no lifecycle trigger path, so both dispatches needed a manual run. The path is now in both trigger lists and the gate regex; tests/ci-workflows keeps the three in sync. --------- Co-authored-by: jun <jun@lidge.dev>
1 participant
Summary
7ce0ba518) ontopreview:release.yml'sbump-dev-versioncaller job now declares thecontents: write+pull-requests: writethat its reusable callee requires. Both v2.40.0 dispatches failed at startup without this;release.ymlruns from the release branch, so the fix has to be onpreviewitself.Verification
tests/ci-workflows.test.ts135 pass on dev; YAML parse confirms the job permissions.previewtip asexpected-sha.Checklist
Summary by CodeRabbit