← Back to issue list

ci: Add missing permissions to QA lint workflow

View original Github issue

Metadata

Project
craft-archives
Number
#256
Type
pull request
State
merged
Author
lengau
Labels
—
Created
Updated
Closed

Current evaluation

Job-level lint permissions PR closed as redundant by maintainer lengau: workflow-level read permissions already configured on main; superseded by merged PR #257 setting workflow-level read permissions.

Resolution: closed superseded

Reason: Maintainer lengau commented (2026-09-24) closing the PR as redundant since the repo uses workflow-level read permissions already present on main. The change was instead delivered by PR #257, which added workflow-level read permissions for actions/contents/pull-requests and removed the lint job overrides.

Evaluated by: mr-cal-bot

No scores available.

Issue body

The QA workflow was invoking the shared lint workflow without the permissions it expects on pull request runs. This updates the lint job to explicitly grant the read access needed for repository contents and PR metadata.

Evaluation history

Date Model Scores Action Summary
stealth/space-bunny-alpha — closed superseded Job-level lint permissions PR closed as redundant by maintainer lengau: workflow-level read permissions already configured on main; superseded by merged PR #257 setting workflow-level read permissions.
stealth/space-bunny-alpha — closed not a bug Closed as redundant: main already had workflow-level read permissions, so the proposed job-level permissions for the shared QA lint workflow were unnecessary.
qwen/qwen3.6-35b-a3b
Impact: 15
Quick Win: 14
Complexity: 5
Confidence: 95
Actionability: 95
needs review Adds missing repository contents and PR metadata permissions to the QA lint workflow. CI is passing, awaiting maintainer review.

Update history

Date Change
updated
closed
updated
updated
created

Related work

Related issues

Issue Project State Summary Similarity
#6438 ci: Add missing permissions to QA lint workflow snapcraft closed PR closed unmerged by lengau as redundant: the QA workflow (.github/workflows/qa.yaml) already grants workflow-level contents/pull-requests read permissions on main, so job-level permissions in the lint job were unnecessary.
91%
#1375 ci: Add missing permissions to QA lint workflow rockcraft closed PR #1375 (rockcraft) adding job-level contents/pull-requests read permissions to the QA lint workflow was closed unmerged by @lengau as redundant — the workflow's existing workflow-level permissions were already sufficient.
91%
#216 ci: Add missing permissions to QA lint workflow craft-grammar closed PR #216 (lengau) added explicit contents/pull-requests read permissions to the QA lint job and was approved, but the lint / files check failed; the PR was closed unmerged after ~8 days with no resolution recorded.
88%
#427 ci: Add missing permissions to QA lint workflow craft-store closed PR #427 (lengau) added job-level contents/pull-requests read permissions to craft-store's QA lint job (+3/-0). All CI checks passed but review stayed pending; closed unmerged in favour of workflow-level fix PR #428.
88%
#257 ci: Set workflow-level read permissions for QA workflow craft-archives merged PR #257 by lengau merged as commit 7179169: moved QA workflow permissions to workflow-level read scopes (actions, contents, pull-requests) and dropped job-local lint overrides, fixing Starflow reusable workflow compilation on PRs.
87%
#1741 ci: Add missing permissions to QA lint workflow craft-parts closed Closed unmerged after the equivalent QA workflow permission fix landed in commit 585b7237.
86%
#600 ci: Add missing permissions to QA lint workflow starbase closed PR #600 was closed unmerged despite all CI checks passing; no merge commit or recorded replacement was found.
83%
#194 ci: Set workflow-level read permissions for QA workflow debcraft merged PR #194 merged: added workflow-level read permissions (actions, contents, pull-requests) to .github/workflows/qa.yaml and removed lint job-level overrides, fixing Starflow reusable workflow compilation on PRs.
83%
#1016 ci: Set workflow-level read permissions for QA workflow craft-providers merged Merged to main via commit a533e67 "ci: Add missing permissions to QA workflow (#1016)", adding workflow-level read permissions (actions, contents, pull-requests) to .github/workflows/qa.yaml.
83%
#1191 ci: Fix QA workflow permissions for reusable lint job craft-application closed PR #1191 was approved but closed unmerged; commit 5353ad50 records its lint permission change, while lint/files and title-policy checks still failed.
82%