ci: fix permissions for QA workflow
Metadata
Current evaluation
Closed unmerged after approval: #1731 proposed explicit read permissions for incoming Starflow QA jobs, but no resolving commit landed and remaining CI checks never completed.
Resolution: closed stale
Reason: The PR received two approvals and reported no CI failures, but remained open with pending checks before being closed. No landed resolution or replacement for #1731 was recorded, indicating abandonment rather than a merged fix.
Evaluated by: mr-cal-bot
No scores available.
Issue body
One of the jobs coming in from Starflow requires explicit 'read' permissions.
- [ ] Have you followed the guidelines for contributing?
- [ ] Have you signed the [CLA](http://www.ubuntu.com/legal/contributors/)?
- [ ] Have you successfully run `make lint && make test`?
- [ ] Have you added an entry to the changelog (`docs/reference/changelog.rst`)?
---
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed stale | Closed unmerged after approval: #1731 proposed explicit read permissions for incoming Starflow QA jobs, but no resolving commit landed and remaining CI checks never completed. | |
| stealth/space-bunny-alpha | — | closed stale | QA workflow permissions fix for Starflow was closed unmerged; no replacement or landed commit was recorded, and CI/review remained unfinished. | |
| qwen/qwen3.6-35b-a3b |
Impact:
20
Quick Win:
14
Complexity:
10
Confidence:
80
Actionability:
80
|
needs review | Adds explicit read permissions to the QA workflow job from Starflow. Small CI fix (+5/-0 lines), all CI checks passing, awaiting review. |
Update history
| Date | Change |
|---|---|
| closed | |
| updated | |
| updated | |
| updated | |
| updated | |
| updated | |
| created |
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #2885 ci: Fix QA reusable workflow permissions for Starflow lint | charmcraft | closed | Closed unmerged as redundant after canonical/starbase#557 merged cd8d4873, adding read-only QA permissions upstream and restoring reusable Starflow lint execution. | |
| #1371 ci: add explicit permissions on QA workflow | rockcraft | closed | Merged explicit read permissions for actions, contents, and pull requests into the QA workflow in commit 559eb218, enabling Starflow path-filter jobs. | |
| #1741 ci: Add missing permissions to QA lint workflow | craft-parts | closed | Closed unmerged after the equivalent QA workflow permission fix landed in commit 585b7237. | |
| #487 ci: Set workflow-level read permissions for QA workflow | craft-cli | merged | PR #487 merged: added workflow-level read permissions (actions, contents, pull-requests) to .github/workflows/qa.yaml so canonical/starflow reusable workflows compile; approved with all CI checks green (+5/-0 lines, 1 file). | |
| #600 ci: Add missing permissions to QA lint workflow | starbase | closed | PR #600 was closed unmerged despite all CI checks passing; no merge commit or recorded replacement was found. | |
| #257 ci: Set workflow-level read permissions for QA workflow | craft-archives | merged | PR #257 by lengau merged as commit 7179169: moved QA workflow permissions to workflow-level read scopes (actions, contents, pull-requests) and dropped job-local lint overrides, fixing Starflow reusable workflow compilation on PRs. | |
| #428 ci: Set workflow-level read permissions for QA workflow | craft-store | merged | Merged as commit 4aabe63: .github/workflows/qa.yaml now sets workflow-level read permissions (actions, contents, pull-requests) and drops job-local lint overrides, fixing Starflow QA workflow failures on PRs. | |
| #194 ci: Set workflow-level read permissions for QA workflow | debcraft | merged | PR #194 merged: added workflow-level read permissions (actions, contents, pull-requests) to .github/workflows/qa.yaml and removed lint job-level overrides, fixing Starflow reusable workflow compilation on PRs. | |
| #216 ci: Add missing permissions to QA lint workflow | craft-grammar | closed | PR #216 (lengau) added explicit contents/pull-requests read permissions to the QA lint job and was approved, but the lint / files check failed; the PR was closed unmerged after ~8 days with no resolution recorded. | |
| #446 ci: Allow QA reusable workflows to read pull request metadata | imagecraft | closed | The QA permissions fix was approved but closed unmerged after the Conventional Commits policy check failed; no resolving commit or replacement was recorded. |