ci: grant id-token to the PR dry-run job - #210
Open
scarmuega wants to merge 1 commit into
Open
Conversation
`pr-check.yml` has failed at startup on every pull request since #204 merged on 2026-05-19. The last run that actually executed was 2026-05-13. #204 added `permissions: id-token: write` to publish-all's `publish-node` job for npm trusted publishing. A reusable workflow cannot request more permission than its caller grants, and `pr-check.yml` caps the whole workflow at `contents: read`, so the call is rejected before any job starts. `release.yml` and `dry-run.yml` declare no top-level `permissions` block, so they inherit the repository default and were unaffected — which is why releases kept publishing while PR validation was silently dead. Granted on the calling job rather than workflow-wide, so the `codegen` job keeps the narrower `contents: read`. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
pr-check.ymlhas failed at startup on every pull request since 2026-05-19. The last run that actually executed was 2026-05-13 — every PR merged since then landed without codegen or packaging validation.Cause
#204 added
permissions: id-token: writetopublish-all.yml'spublish-nodejob for npm trusted publishing. A reusable workflow cannot request more permission than its caller grants, andpr-check.yml:14-15caps the whole workflow atcontents: read. The call is rejected before any job starts, so the run reportsstartup_failurein ~1s with no logs.release.ymlanddry-run.ymldeclare no top-levelpermissionsblock, so they inherit the repository default and were unaffected. That's why releases kept publishing normally while PR validation was silently dead — the breakage left no trace anywhere anyone was looking.Fix
Grant
id-token: writeon thepublish-dry-runjob rather than workflow-wide, so thecodegenjob keeps the narrowercontents: read.Verifying
This PR is its own test: if
pr-check.ymlstarts and the six dry-run publish jobs report, the fix works. Forpull_requestevents the workflow definition comes from the PR head, so no merge is needed to see it take effect.Worth noting the runs that do start may still fail on their own merits — the last executing run (2026-05-13) was itself a
failure. Getting paststartup_failureis the goal here; anything it surfaces afterward is a separate finding.🤖 Generated with Claude Code