← Back to issue list

ci: Set workflow-level read permissions for QA workflow

View original Github issue

Metadata

Project
craft-artifacts
Number
#94
Type
pull request
State
merged
Author
lengau
Labels
—
Created
Updated
Closed

Current evaluation

Merged PR #94 as df2d092, adding workflow-level read permissions for actions, contents, and pull requests so QA's Starflow reusable workflows can access required metadata.

Resolution: closed resolved

Reason: PR #94 was approved and merged as commit df2d092, resolving pull-request workflow compilation failures caused by missing read scopes.

Evaluated by: mr-cal-bot

No scores available.

Issue body

The QA workflow invokes reusable workflows from `canonical/starflow` (such as `lint-python.yaml`), which require read access for repository contents and pull request metadata. Because these scopes are purely read-only, this updates `.github/workflows/qa.yaml` to configure workflow-level read permissions: - `actions: read` - `contents: read` - `pull-requests: read` • **What changed**: • Added a top-level `permissions` block with read scopes for actions, contents, and pull requests. • Removed job-local permission overrides under `lint:` so jobs inherit these scopes cleanly. • **Why this matters**: • Resolves workflow compilation failures on pull request runs where Starflow reusable workflows require `pull-requests: read`. • Follows the workflow-level read-only permission pattern used across Starflow-enabled repositories.

Evaluation history

Date Model Scores Action Summary
stealth/space-bunny-alpha — closed resolved Merged PR #94 as df2d092, adding workflow-level read permissions for actions, contents, and pull requests so QA's Starflow reusable workflows can access required metadata.
stealth/space-bunny-alpha — closed resolved Merged as commit df2d092 in craft-artifacts: added workflow-level read permissions (actions, contents, pull-requests) to .github/workflows/qa.yaml and dropped lint job overrides so canonical/starflow reusable workflows compile.
stealth/space-bunny-alpha — closed resolved Merged workflow-level read permissions for actions, contents and pull requests, allowing QA to invoke Starflow reusable workflows. The upstream change is canonical/starbase#557, commit cd8d487.
stealth/space-bunny-alpha
Impact: 24
Quick Win: 17
Complexity: 6
Confidence: 94
Actionability: 76
needs review Centralizes QA workflow access as actions, contents, and pull-requests read permissions. Approved with no unresolved comments; CLA and all Fast/Slow tests pass, but typecheck-with-ty remains failing.
stealth/space-bunny-alpha
Impact: 35
Quick Win: 25
Complexity: 12
Confidence: 84
Actionability: 80
needs review Maintainer PR adds top-level read-only permissions (actions, contents, pull-requests) to .github/workflows/qa.yaml and drops job-local lint permissions, fixing Starflow reusable workflow compile failures. Fresh, unreviewed; all checks pass except typecheck-with-ty.
qwen/qwen3.6-35b-a3b
Impact: 10
Quick Win: 7
Complexity: 5
Confidence: 85
Actionability: 75
needs review Adds missing permissions to the QA lint workflow for read access to repo contents and PR metadata. Clean 3-line diff awaiting review.

Update history

Date Change
merged
updated
updated
updated
updated
created

Related work

  • Related To: canonical/starbase#557 (confidence 95%)

    Merged as cd8d487; introduced the analogous upstream read-permission pattern for Starflow QA workflows.

Related issues

Issue Project State Summary Similarity
#487 ci: Set workflow-level read permissions for QA workflow craft-cli merged PR #487 merged: added workflow-level read permissions (actions, contents, pull-requests) to .github/workflows/qa.yaml so canonical/starflow reusable workflows compile; approved with all CI checks green (+5/-0 lines, 1 file).
93%
#194 ci: Set workflow-level read permissions for QA workflow debcraft merged PR #194 merged: added workflow-level read permissions (actions, contents, pull-requests) to .github/workflows/qa.yaml and removed lint job-level overrides, fixing Starflow reusable workflow compilation on PRs.
93%
#428 ci: Set workflow-level read permissions for QA workflow craft-store merged Merged as commit 4aabe63: .github/workflows/qa.yaml now sets workflow-level read permissions (actions, contents, pull-requests) and drops job-local lint overrides, fixing Starflow QA workflow failures on PRs.
92%
#257 ci: Set workflow-level read permissions for QA workflow craft-archives merged PR #257 by lengau merged as commit 7179169: moved QA workflow permissions to workflow-level read scopes (actions, contents, pull-requests) and dropped job-local lint overrides, fixing Starflow reusable workflow compilation on PRs.
92%
#1016 ci: Set workflow-level read permissions for QA workflow craft-providers merged Merged to main via commit a533e67 "ci: Add missing permissions to QA workflow (#1016)", adding workflow-level read permissions (actions, contents, pull-requests) to .github/workflows/qa.yaml.
90%
#1371 ci: add explicit permissions on QA workflow rockcraft closed Merged explicit read permissions for actions, contents, and pull requests into the QA workflow in commit 559eb218, enabling Starflow path-filter jobs.
87%
#557 ci: set read permissions for qa workflow starbase merged Merged PR #557 as commit cd8d487, granting the QA workflow read-only contents and pull-request permissions so paths-filter can access GitHub APIs.
86%
#256 ci: Add missing permissions to QA lint workflow craft-archives merged Job-level lint permissions PR closed as redundant by maintainer lengau: workflow-level read permissions already configured on main; superseded by merged PR #257 setting workflow-level read permissions.
80%
#1731 ci: fix permissions for QA workflow craft-parts closed Closed unmerged after approval: #1731 proposed explicit read permissions for incoming Starflow QA jobs, but no resolving commit landed and remaining CI checks never completed.
80%
#2885 ci: Fix QA reusable workflow permissions for Starflow lint charmcraft closed Closed unmerged as redundant after canonical/starbase#557 merged cd8d4873, adding read-only QA permissions upstream and restoring reusable Starflow lint execution.
79%