fix(deploy): [INFRA-670] drop actions: write that breaks every artifacts-cicd consumer - #287
Merged
Merged
Conversation
…sted - Six docs still required actions: write/read for the metadata handoff; both transfers are same-run. - Troubleshooting now says to move off the affected refs instead of granting the permission. - Drops the unused actions: write from the two examples and the integration test.
- A POM inheriting fields from <parent> resolved empty and clobbered good values. - Adds a regression test; it fails without the guard. - The test sets -e locally because setup() disables errexit, making bare assertions inert.
- Explaining an absent requirement adds a concept to hold without changing what to do. - Drops the validation-error troubleshooting entries; that error cannot occur at this ref.
- Keeps this PR to the permission fix; the guard patches an unrelated flat-JAR change. - Guard and its tests continue on fix/INFRA-673-jar-metadata-inherited-pom.
alexs-aero
self-requested a review
August 7, 2026 14:47
Contributor
Author
|
step security warning false positive (mirror is valid) merging. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Since v4.0.0, every workflow that calls
reusable_artifacts-cicdfails as an invalid workflow before a single job starts:artifacts-cicdgrants its children{contents: read, id-token: write}.b4cb401(#251) addedactions: writeto thedeployjob andactions: readtocreate-release-bundle, and a nested job cannot request more than its caller holds. Neither is used: both jobs only move artifacts within the current run.INFRA-670
Changes
reusable_deploy-artifacts.yaml: dropactions: write.reusable_create-release-bundle.yaml: dropactions: read.check_reusable_workflow_permissions.shand its bats test, which required both. The guardrail was asserting the bug.test_composable-minimal-permissions.yaml: drop the NuGet fixtures so it runs without SSL.com secrets.Why this didn't cause a failure that was caught?
A workflow that fails validation produces no check runs, so the pull request reports green:
mainis protected by rulesets covering review and force-push, but none of them contains arequired_status_checksrule, so a workflow that never reported blocked nothing.Two tests would have caught this on the day it landed.
test_artifacts-cicd.yamlgrants exactly what a consumer grants, and it startup-failed on every branch from 2026-06-08 until this PR.test_composable-minimal-permissions.yaml, added by #276 as evidence that the permissions were correct, has never passed once: the ceiling stopped it from starting, and behind that it was missing the SSL.com secrets its NuGet fixtures demand.The docs drifted the same way. Six files told consumers to grant
actions: writeandactions: read, andcreate-release-bundle/README.mddocumented a caller workaround that was never true, since a job requests its permissions unconditionally and validation never reads input values.Unblocks the
aerospike-graph-serviceonboarding (INFRA-669), pinned to v3.7.0 until this ships.Related
#288 (INFRA-673) guards the flat-JAR sibling-POM path added here. Stacked on this branch.
87 tests across three bats files cannot fail: their
setup()runsset +eu; trap - ERR, which is how bats detects a failed assertion, so every bare[[ ]]is inert. Needs its own ticket.