ci: Fix QA workflow permissions for reusable lint job
Metadata
Current evaluation
PR #1191 was approved but closed unmerged; commit 5353ad50 records its lint permission change, while lint/files and title-policy checks still failed.
Resolution: closed stale
Reason: The PR was closed without a merge or superseding reference. Although 5353ad50 records the intended lint permission change, the reported lint/files and title-policy checks remained failed, so no complete resolution is evidenced.
Evaluated by: mr-cal-bot
No scores available.
Issue body
The QA workflow became invalid because the reusable lint workflow now requires `pull-requests: read` in its nested `files` job. As written, `qa.yaml` did not grant that permission, so GitHub rejected the workflow before any jobs could start.
- **Workflow permission alignment**
- Added an explicit `permissions` block to the `lint` job in `.github/workflows/qa.yaml`.
- Grants only the scopes required by `canonical/starflow/.github/workflows/lint-python.yaml@main`:
- `contents: read`
- `pull-requests: read`
- **Scope of change**
- Limits the permission update to the reusable `lint` job only.
- Leaves the `test` and `test-flaky` jobs unchanged.
- **Result**
- Restores compatibility with the called reusable workflow and allows the QA workflow to be parsed and scheduled again.
```yaml
jobs:
lint:
uses: canonical/starflow/.github/workflows/lint-python.yaml@main
permissions:
contents: read
pull-requests: read
```
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed stale | PR #1191 was approved but closed unmerged; commit 5353ad50 records its lint permission change, while lint/files and title-policy checks still failed. | |
| stealth/space-bunny-alpha | — | closed resolved | QA workflow permissions were fixed in commit 5353ad50 via PR #1191, granting the reusable lint job contents and pull-requests read access. | |
| stealth/space-bunny-alpha | — | closed stale | PR #1191 was approved but closed unmerged; it added read permissions for the reusable QA lint job, but lint/files and title-policy checks still failed. | |
| qwen/qwen3.6-35b-a3b |
Impact:
55
Quick Win:
32
Complexity:
10
Confidence:
75
Actionability:
65
|
needs review | Adds explicit permissions to QA workflow lint job to fix reusable workflow compatibility. Small change (+3/-0 lines). CI mostly passing; lint/files and PR title format checks failing. No reviewers yet. |
Update history
| Date | Change |
|---|---|
| closed | |
| updated | |
| created |
Related work
-
Related To:
5353ad50
(confidence 90%)
The repository log records the reusable lint workflow permission change associated with PR #1191.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #216 ci: Add missing permissions to QA lint workflow | craft-grammar | closed | PR #216 (lengau) added explicit contents/pull-requests read permissions to the QA lint job and was approved, but the lint / files check failed; the PR was closed unmerged after ~8 days with no resolution recorded. | |
| #6438 ci: Add missing permissions to QA lint workflow | snapcraft | closed | PR closed unmerged by lengau as redundant: the QA workflow (.github/workflows/qa.yaml) already grants workflow-level contents/pull-requests read permissions on main, so job-level permissions in the lint job were unnecessary. | |
| #1741 ci: Add missing permissions to QA lint workflow | craft-parts | closed | Closed unmerged after the equivalent QA workflow permission fix landed in commit 585b7237. | |
| #600 ci: Add missing permissions to QA lint workflow | starbase | closed | PR #600 was closed unmerged despite all CI checks passing; no merge commit or recorded replacement was found. | |
| #427 ci: Add missing permissions to QA lint workflow | craft-store | closed | PR #427 (lengau) added job-level contents/pull-requests read permissions to craft-store's QA lint job (+3/-0). All CI checks passed but review stayed pending; closed unmerged in favour of workflow-level fix PR #428. | |
| #1375 ci: Add missing permissions to QA lint workflow | rockcraft | closed | PR #1375 (rockcraft) adding job-level contents/pull-requests read permissions to the QA lint workflow was closed unmerged by @lengau as redundant — the workflow's existing workflow-level permissions were already sufficient. | |
| #256 ci: Add missing permissions to QA lint workflow | craft-archives | merged | Job-level lint permissions PR closed as redundant by maintainer lengau: workflow-level read permissions already configured on main; superseded by merged PR #257 setting workflow-level read permissions. | |
| #193 ci: Add missing permissions to QA lint workflow | debcraft | closed | Closed unmerged: all16 CI checks passed (incl. zizmor, lint / files, CLA) but review stayed pending (0 reviewers, 0 comments) and no merge commit or superseding change was recorded. | |
| #2885 ci: Fix QA reusable workflow permissions for Starflow lint | charmcraft | closed | Closed unmerged as redundant after canonical/starbase#557 merged cd8d4873, adding read-only QA permissions upstream and restoring reusable Starflow lint execution. | |
| #446 ci: Allow QA reusable workflows to read pull request metadata | imagecraft | closed | The QA permissions fix was approved but closed unmerged after the Conventional Commits policy check failed; no resolving commit or replacement was recorded. |