ci: Fix QA reusable workflow permissions for Starflow lint
Metadata
Current evaluation
Closed unmerged as redundant after canonical/starbase#557 merged cd8d4873, adding read-only QA permissions upstream and restoring reusable Starflow lint execution.
Resolution: closed superseded
Reason: canonical/starbase#557 merged as commit cd8d4873 with read-only QA workflow permissions, replacing the need for charmcraft#2885's caller-side lint permissions. Charmcraft#2885 was closed without merging.
Evaluated by: mr-cal-bot
No scores available.
Issue body
The QA workflow became invalid because the reusable `lint-python.yaml` workflow now contains a nested job that requests `pull-requests: read`, but the caller did not permit that scope. This updates the caller-side job permissions so GitHub can resolve and run the reusable lint workflow again.
- **Problem**
- `qa.yaml` failed workflow validation before execution.
- The `lint` job called `canonical/starflow/.github/workflows/lint-python.yaml@main`, whose nested `files` job now requires `pull-requests: read`.
- **Change**
- Add explicit permissions to `jobs.lint` in `.github/workflows/qa.yaml`:
- `contents: read`
- `pull-requests: read`
- **Effect**
- Restores compatibility with the current Starflow reusable lint workflow.
- Keeps the permission grant scoped to the `lint` caller job instead of widening workflow-level permissions.
```yaml
lint:
permissions:
contents: read
pull-requests: read
uses: canonical/starflow/.github/workflows/lint-python.yaml@main
```
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed superseded | Closed unmerged as redundant after canonical/starbase#557 merged cd8d4873, adding read-only QA permissions upstream and restoring reusable Starflow lint execution. | |
| stealth/space-bunny-alpha | — | closed superseded | Closed unmerged after canonical/starbase#557 superseded the job-scoped proposal with merged read-only QA permissions, restoring reusable Starflow lint execution. | |
| qwen/qwen3.6-35b-a3b |
Impact:
50
Quick Win:
36
Complexity:
10
Confidence:
90
Actionability:
80
|
needs review | Adds explicit permissions to the lint job in qa.yaml to fix workflow validation failure caused by starflow's reusable lint-python.yaml requiring pull-requests: read scope. |
Update history
| Date | Change |
|---|---|
| closed | |
| updated | |
| updated | |
| created |
Related work
-
Superseded By:
canonical/starbase#557
(confidence 96%)
Merged upstream permissions fix addressed the reusable-workflow compilation failure.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #1731 ci: fix permissions for QA workflow | craft-parts | closed | Closed unmerged after approval: #1731 proposed explicit read permissions for incoming Starflow QA jobs, but no resolving commit landed and remaining CI checks never completed. | |
| #1371 ci: add explicit permissions on QA workflow | rockcraft | closed | Merged explicit read permissions for actions, contents, and pull requests into the QA workflow in commit 559eb218, enabling Starflow path-filter jobs. | |
| #1741 ci: Add missing permissions to QA lint workflow | craft-parts | closed | Closed unmerged after the equivalent QA workflow permission fix landed in commit 585b7237. | |
| #257 ci: Set workflow-level read permissions for QA workflow | craft-archives | merged | PR #257 by lengau merged as commit 7179169: moved QA workflow permissions to workflow-level read scopes (actions, contents, pull-requests) and dropped job-local lint overrides, fixing Starflow reusable workflow compilation on PRs. | |
| #1191 ci: Fix QA workflow permissions for reusable lint job | craft-application | closed | PR #1191 was approved but closed unmerged; commit 5353ad50 records its lint permission change, while lint/files and title-policy checks still failed. | |
| #428 ci: Set workflow-level read permissions for QA workflow | craft-store | merged | Merged as commit 4aabe63: .github/workflows/qa.yaml now sets workflow-level read permissions (actions, contents, pull-requests) and drops job-local lint overrides, fixing Starflow QA workflow failures on PRs. | |
| #194 ci: Set workflow-level read permissions for QA workflow | debcraft | merged | PR #194 merged: added workflow-level read permissions (actions, contents, pull-requests) to .github/workflows/qa.yaml and removed lint job-level overrides, fixing Starflow reusable workflow compilation on PRs. | |
| #487 ci: Set workflow-level read permissions for QA workflow | craft-cli | merged | PR #487 merged: added workflow-level read permissions (actions, contents, pull-requests) to .github/workflows/qa.yaml so canonical/starflow reusable workflows compile; approved with all CI checks green (+5/-0 lines, 1 file). | |
| #6438 ci: Add missing permissions to QA lint workflow | snapcraft | closed | PR closed unmerged by lengau as redundant: the QA workflow (.github/workflows/qa.yaml) already grants workflow-level contents/pull-requests read permissions on main, so job-level permissions in the lint job were unnecessary. | |
| #94 ci: Set workflow-level read permissions for QA workflow | craft-artifacts | merged | Merged PR #94 as df2d092, adding workflow-level read permissions for actions, contents, and pull requests so QA's Starflow reusable workflows can access required metadata. |