ci: Set workflow-level read permissions for QA workflow
Metadata
Current evaluation
Merged to main via commit a533e67 "ci: Add missing permissions to QA workflow (#1016)", adding workflow-level read permissions (actions, contents, pull-requests) to .github/workflows/qa.yaml.
Resolution: closed resolved
Reason: PR #1016 was approved with all CI checks green and merged into main; commit a533e67 ("ci: Add missing permissions to QA workflow (#1016)") is the head commit touching .github/workflows/qa.yaml, adding a top-level permissions block and removing lint job-level overrides so canonical/starflow reusable workflows compile.
Evaluated by: mr-cal-bot
No scores available.
Issue body
The QA workflow invokes reusable workflows from `canonical/starflow` (such as `lint-python.yaml`), which require read access for repository contents and pull request metadata.
Because these scopes are purely read-only, this updates `.github/workflows/qa.yaml` to configure workflow-level read permissions:
- `actions: read`
- `contents: read`
- `pull-requests: read`
• **What changed**:
• Added a top-level `permissions` block with read scopes for actions, contents, and pull requests.
• Removed job-local permission overrides under `lint:` so jobs inherit these scopes cleanly.
• **Why this matters**:
• Resolves workflow compilation failures on pull request runs where Starflow reusable workflows require `pull-requests: read`.
• Follows the workflow-level read-only permission pattern used across Starflow-enabled repositories.
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Merged to main via commit a533e67 "ci: Add missing permissions to QA workflow (#1016)", adding workflow-level read permissions (actions, contents, pull-requests) to .github/workflows/qa.yaml. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged canonical/craft-archives#257, adding workflow-level read access for actions, contents, and pull requests so Starflow QA workflows compile. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged QA workflow permissions update, granting actions, contents, and pull requests read access so Starflow reusable workflows compile and run on pull requests. | |
| stealth/space-bunny-alpha | — | closed resolved | QA lint permissions were updated to read repository contents and PR metadata; the five-line CI fix was approved with all completed checks passing and no unresolved review comments. | |
| qwen/qwen3.6-35b-a3b |
Impact:
10
Quick Win:
8
Complexity:
5
Confidence:
85
Actionability:
80
|
needs review | Add explicit permissions to the QA lint workflow job to grant read access for repository contents and PR metadata on pull request runs. |
Update history
| Date | Change |
|---|---|
| updated | |
| closed | |
| updated | |
| updated | |
| updated | |
| created |
Related work
-
Related To:
canonical/starbase#557
(confidence 72%)
Central starbase PR carrying the same QA workflow permissions change into other Starflow-enabled repos (e.g. craft-store#428).
-
Related To:
canonical/craft-archives#257
(confidence 70%)
Identical workflow-level read permissions change to qa.yaml in craft-archives.
-
Related To:
canonical/craft-cli#487
(confidence 68%)
Same merged change (+5/-0, 1 file) applied to craft-cli's qa.yaml.
-
Related To:
canonical/debcraft#194
(confidence 65%)
Same QA workflow permissions change merged in debcraft.
-
Related To:
canonical/charmcraft#2885
(confidence 55%)
Earlier job-scoped variant of this fix, closed unmerged once the workflow-level pattern was adopted.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #487 ci: Set workflow-level read permissions for QA workflow | craft-cli | merged | PR #487 merged: added workflow-level read permissions (actions, contents, pull-requests) to .github/workflows/qa.yaml so canonical/starflow reusable workflows compile; approved with all CI checks green (+5/-0 lines, 1 file). | |
| #194 ci: Set workflow-level read permissions for QA workflow | debcraft | merged | PR #194 merged: added workflow-level read permissions (actions, contents, pull-requests) to .github/workflows/qa.yaml and removed lint job-level overrides, fixing Starflow reusable workflow compilation on PRs. | |
| #428 ci: Set workflow-level read permissions for QA workflow | craft-store | merged | Merged as commit 4aabe63: .github/workflows/qa.yaml now sets workflow-level read permissions (actions, contents, pull-requests) and drops job-local lint overrides, fixing Starflow QA workflow failures on PRs. | |
| #94 ci: Set workflow-level read permissions for QA workflow | craft-artifacts | merged | Merged PR #94 as df2d092, adding workflow-level read permissions for actions, contents, and pull requests so QA's Starflow reusable workflows can access required metadata. | |
| #257 ci: Set workflow-level read permissions for QA workflow | craft-archives | merged | PR #257 by lengau merged as commit 7179169: moved QA workflow permissions to workflow-level read scopes (actions, contents, pull-requests) and dropped job-local lint overrides, fixing Starflow reusable workflow compilation on PRs. | |
| #557 ci: set read permissions for qa workflow | starbase | merged | Merged PR #557 as commit cd8d487, granting the QA workflow read-only contents and pull-request permissions so paths-filter can access GitHub APIs. | |
| #256 ci: Add missing permissions to QA lint workflow | craft-archives | merged | Job-level lint permissions PR closed as redundant by maintainer lengau: workflow-level read permissions already configured on main; superseded by merged PR #257 setting workflow-level read permissions. | |
| #1371 ci: add explicit permissions on QA workflow | rockcraft | closed | Merged explicit read permissions for actions, contents, and pull requests into the QA workflow in commit 559eb218, enabling Starflow path-filter jobs. | |
| #1375 ci: Add missing permissions to QA lint workflow | rockcraft | closed | PR #1375 (rockcraft) adding job-level contents/pull-requests read permissions to the QA lint workflow was closed unmerged by @lengau as redundant — the workflow's existing workflow-level permissions were already sufficient. | |
| #6438 ci: Add missing permissions to QA lint workflow | snapcraft | closed | PR closed unmerged by lengau as redundant: the QA workflow (.github/workflows/qa.yaml) already grants workflow-level contents/pull-requests read permissions on main, so job-level permissions in the lint job were unnecessary. |