← Back to issue list

ci: add actions: read permission to policy job

View original Github issue

Metadata

Project
craft-cli
Number
#477
Type
pull request
State
merged
Author
lengau
Labels
—
Created
Updated
Closed

Current evaluation

Merged a single-line update granting actions: read permissions to the GitHub Actions policy job. This prevents workflow failures by aligning with required upstream permissions. Approved and passed all CI checks.

Suggested action: —

No scores available.

Issue body

## Description Adds `actions: read` to the `policy` job's permissions in `.github/workflows/policy.yaml`, matching [Snapcraft's policy workflow](https://github.com/canonical/snapcraft/blob/main/.github/workflows/policy.yaml). The policy workflow (via starflow) requires read access to actions; without this permission the job can fail.

Evaluation history

Date Model Scores Action Summary
qwen/qwen3.6-35b-a3b — — Merged a single-line update granting actions: read permissions to the GitHub Actions policy job. This prevents workflow failures by aligning with required upstream permissions. Approved and passed all CI checks.

Update history

Date Change
created

Related issues

Issue Project State Summary Similarity
#557 ci: set read permissions for qa workflow starbase merged Merged updates granting explicit read permissions to the QA workflow. This allows internal projects to run GitHub API-dependent actions like paths-filter. Approved by two reviewers with all CI checks passing.
76%
#591 ci: add zizmor actions permission starbase merged Merged to update GitHub Actions permissions for the zizmor security scanner. Approved by one reviewer with all CI checks passing.
72%
#6352 ci: give copilot collections job the right perms snapcraft merged Merged to grant correct permissions to the CI copilot collections job. Approved by two reviewers, the change resolves permission errors in the referenced GitHub Actions run. Updated one file with four added lines.
71%
#251 ci: update permissions for zizmor craft-archives merged Merged after approval and passing CI checks. Updated GitHub Actions permissions for the zizmor security scanner with a single-line configuration change.
71%