ci: Add missing permissions to QA lint workflow
Metadata
Current evaluation
PR #427 (lengau) added job-level contents/pull-requests read permissions to craft-store's QA lint job (+3/-0). All CI checks passed but review stayed pending; closed unmerged in favour of workflow-level fix PR #428.
Resolution: closed superseded
Reason: The job-level permission grant was closed unmerged and replaced by PR #428, which was merged and set workflow-level read permissions (actions, contents, pull-requests) on .github/workflows/qa.yaml — the same change landed as canonical/starbase#557 (commit cd8d487). Sibling PRs (craft-store#428, craft-cli#487, debcraft#194, craft-archives#257, craft-providers#1016) show the same job-level variant closed as redundant in favour of the workflow-level fix.
Evaluated by: mr-cal-bot
Issue body
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed superseded | PR #427 (lengau) added job-level contents/pull-requests read permissions to craft-store's QA lint job (+3/-0). All CI checks passed but review stayed pending; closed unmerged in favour of workflow-level fix PR #428. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged as commit 5876e09, granting the QA lint job read access to repository contents and PR metadata; follow-up #428 added workflow-level permissions. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged as commit 5876e09, granting QA lint read access to repository contents and PR metadata; follow-up #428 moved read permissions to workflow level. | |
| stealth/space-bunny-alpha | — | closed stale | Closed unmerged after 8 days with all CI checks green but no review, approval, or comments. The +3-line job-level contents/pull-requests permissions added to the QA lint job never landed, and no superseding commit is recorded. | |
| stealth/space-bunny-alpha | — | closed stale | PR #427 was closed after all CI checks passed, but no merge, commit, reviewer feedback, or closing rationale was recorded. | |
| stealth/space-bunny-alpha | — | closed stale | Closed without a recorded resolution: CI passed, but review remained pending and no comments, merge, or superseding change were documented. | |
| stealth/space-bunny-alpha | — | closed stale | Closed unmerged after CI passed; the QA lint job’s explicit read permissions were not merged, and no replacement was recorded. | |
| qwen/qwen3.6-35b-a3b |
Impact:
20
Quick Win:
15
Complexity:
5
Confidence:
85
Actionability:
80
|
needs review | Adds missing permissions to the QA lint workflow job. Clean 3-line change, all CI passing, awaiting maintainer review. |
Update history
| Date | Change |
|---|---|
| closed | |
| updated | |
| created |
Related work
-
Superseded By:
canonical/craft-store#428
(confidence 96%)
Merged PR that set workflow-level read permissions for actions, contents and pull-requests in qa.yaml, resolving the same Starflow lint compilation problem.
-
Likely Fixed By:
canonical/starbase#557
(confidence 90%)
Upstream reusable-workflow change (merged as commit cd8d487) granting read-only contents and pull-request access; craft-store#428's summary credits it as the actual fix.
-
Duplicate Of:
canonical/rockcraft#1375
(confidence 70%)
Identical job-level permissions PR closed unmerged by lengau as redundant, since workflow-level permissions were already sufficient.
-
Related To:
canonical/craft-cli#487
(confidence 65%)
Same cross-repo migration to workflow-level QA read permissions, merged successfully where the job-level variant was dropped.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #1375 ci: Add missing permissions to QA lint workflow | rockcraft | closed | PR #1375 (rockcraft) adding job-level contents/pull-requests read permissions to the QA lint workflow was closed unmerged by @lengau as redundant — the workflow's existing workflow-level permissions were already sufficient. | |
| #216 ci: Add missing permissions to QA lint workflow | craft-grammar | closed | PR #216 (lengau) added explicit contents/pull-requests read permissions to the QA lint job and was approved, but the lint / files check failed; the PR was closed unmerged after ~8 days with no resolution recorded. | |
| #6438 ci: Add missing permissions to QA lint workflow | snapcraft | closed | PR closed unmerged by lengau as redundant: the QA workflow (.github/workflows/qa.yaml) already grants workflow-level contents/pull-requests read permissions on main, so job-level permissions in the lint job were unnecessary. | |
| #256 ci: Add missing permissions to QA lint workflow | craft-archives | merged | Job-level lint permissions PR closed as redundant by maintainer lengau: workflow-level read permissions already configured on main; superseded by merged PR #257 setting workflow-level read permissions. | |
| #600 ci: Add missing permissions to QA lint workflow | starbase | closed | PR #600 was closed unmerged despite all CI checks passing; no merge commit or recorded replacement was found. | |
| #1741 ci: Add missing permissions to QA lint workflow | craft-parts | closed | Closed unmerged after the equivalent QA workflow permission fix landed in commit 585b7237. | |
| #193 ci: Add missing permissions to QA lint workflow | debcraft | closed | Closed unmerged: all16 CI checks passed (incl. zizmor, lint / files, CLA) but review stayed pending (0 reviewers, 0 comments) and no merge commit or superseding change was recorded. | |
| #1191 ci: Fix QA workflow permissions for reusable lint job | craft-application | closed | PR #1191 was approved but closed unmerged; commit 5353ad50 records its lint permission change, while lint/files and title-policy checks still failed. | |
| #257 ci: Set workflow-level read permissions for QA workflow | craft-archives | merged | PR #257 by lengau merged as commit 7179169: moved QA workflow permissions to workflow-level read scopes (actions, contents, pull-requests) and dropped job-local lint overrides, fixing Starflow reusable workflow compilation on PRs. | |
| #194 ci: Set workflow-level read permissions for QA workflow | debcraft | merged | PR #194 merged: added workflow-level read permissions (actions, contents, pull-requests) to .github/workflows/qa.yaml and removed lint job-level overrides, fixing Starflow reusable workflow compilation on PRs. |