.github/workflows/rainix-copy-artifacts.yaml's copy-artifacts job sets no permissions:, and neither does any of the sixteen consumers that call it. So every one inherits the repository default GITHUB_TOKEN permissions for a job that only does actions/checkout, a rebuild, and git diff --exit-code.
It needs contents: read.
Setting it on the reusable's own job covers all sixteen consumers at once. Setting it consumer-side would need sixteen identical edits and would add a per-repo variation to the exact check whose inconsistency rainlanguage/rain.deploy#152 and its thirteen sibling issues were filed to remove.
The org already has the pattern, just not on the shared path: rain.solver's hand-rolled equivalent sets permissions: {id-token: write, contents: read}.
Raised by CodeRabbit against rainlanguage/rain.extrospection.deploy#8; declined there as org-wide.
.github/workflows/rainix-copy-artifacts.yaml'scopy-artifactsjob sets nopermissions:, and neither does any of the sixteen consumers that call it. So every one inherits the repository defaultGITHUB_TOKENpermissions for a job that only doesactions/checkout, a rebuild, andgit diff --exit-code.It needs
contents: read.Setting it on the reusable's own job covers all sixteen consumers at once. Setting it consumer-side would need sixteen identical edits and would add a per-repo variation to the exact check whose inconsistency rainlanguage/rain.deploy#152 and its thirteen sibling issues were filed to remove.
The org already has the pattern, just not on the shared path: rain.solver's hand-rolled equivalent sets
permissions: {id-token: write, contents: read}.Raised by CodeRabbit against rainlanguage/rain.extrospection.deploy#8; declined there as org-wide.