ci: Add missing permissions to QA lint workflow
Metadata
Current evaluation
Closed unmerged: all16 CI checks passed (incl. zizmor, lint / files, CLA) but review stayed pending (0 reviewers, 0 comments) and no merge commit or superseding change was recorded.
Resolution: closed stale
Reason: The +3/-0 permission grant was never merged — the PR shows zero reviewers, no comments, and review status still pending at close, with no resolving commit or replacement PR recorded in the project history. All checks passing with no maintainer explanation matches an abandonment rather than a rejection or fix.
Evaluated by: mr-cal-bot
No scores available.
Issue body
The QA workflow was invoking the shared lint workflow without the permissions it expects on pull request runs. This updates the lint job to explicitly grant the read access needed for repository contents and PR metadata.
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed stale | Closed unmerged: all16 CI checks passed (incl. zizmor, lint / files, CLA) but review stayed pending (0 reviewers, 0 comments) and no merge commit or superseding change was recorded. | |
| stealth/space-bunny-alpha | — | closed stale | Closed unmerged: all CI checks passed, but review remained pending, with no merge commit, superseding reference, or maintainer explanation provided. | |
| qwen/qwen3.6-35b-a3b |
Impact:
25
Quick Win:
20
Complexity:
5
Confidence:
90
Actionability:
85
|
needs review | Adds explicit job-level permissions (contents: read, pull-requests: read) to the lint job in qa.yaml to fix reusable workflow access on PR runs. All CI checks passing. |
Update history
| Date | Change |
|---|---|
| closed | |
| updated | |
| updated | |
| updated | |
| created |
Related work
-
Related To:
canonical/craft-grammar#216
(confidence 55%)
Identical 'ci: Add missing permissions to QA lint workflow' change in a sibling project, also closed unmerged.
-
Related To:
canonical/starbase#600
(confidence 50%)
Same-titled permissions PR in another Canonical repo; also closed without a recorded merge.
-
Related To:
canonical/craft-application#1191
(confidence 45%)
Parallel fix for the reusable QA lint job permissions, approved but closed unmerged.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #600 ci: Add missing permissions to QA lint workflow | starbase | closed | PR #600 was closed unmerged despite all CI checks passing; no merge commit or recorded replacement was found. | |
| #1741 ci: Add missing permissions to QA lint workflow | craft-parts | closed | Closed unmerged after the equivalent QA workflow permission fix landed in commit 585b7237. | |
| #216 ci: Add missing permissions to QA lint workflow | craft-grammar | closed | PR #216 (lengau) added explicit contents/pull-requests read permissions to the QA lint job and was approved, but the lint / files check failed; the PR was closed unmerged after ~8 days with no resolution recorded. | |
| #427 ci: Add missing permissions to QA lint workflow | craft-store | closed | PR #427 (lengau) added job-level contents/pull-requests read permissions to craft-store's QA lint job (+3/-0). All CI checks passed but review stayed pending; closed unmerged in favour of workflow-level fix PR #428. | |
| #6438 ci: Add missing permissions to QA lint workflow | snapcraft | closed | PR closed unmerged by lengau as redundant: the QA workflow (.github/workflows/qa.yaml) already grants workflow-level contents/pull-requests read permissions on main, so job-level permissions in the lint job were unnecessary. | |
| #1191 ci: Fix QA workflow permissions for reusable lint job | craft-application | closed | PR #1191 was approved but closed unmerged; commit 5353ad50 records its lint permission change, while lint/files and title-policy checks still failed. | |
| #1375 ci: Add missing permissions to QA lint workflow | rockcraft | closed | PR #1375 (rockcraft) adding job-level contents/pull-requests read permissions to the QA lint workflow was closed unmerged by @lengau as redundant — the workflow's existing workflow-level permissions were already sufficient. | |
| #256 ci: Add missing permissions to QA lint workflow | craft-archives | merged | Job-level lint permissions PR closed as redundant by maintainer lengau: workflow-level read permissions already configured on main; superseded by merged PR #257 setting workflow-level read permissions. | |
| #1731 ci: fix permissions for QA workflow | craft-parts | closed | Closed unmerged after approval: #1731 proposed explicit read permissions for incoming Starflow QA jobs, but no resolving commit landed and remaining CI checks never completed. | |
| #446 ci: Allow QA reusable workflows to read pull request metadata | imagecraft | closed | The QA permissions fix was approved but closed unmerged after the Conventional Commits policy check failed; no resolving commit or replacement was recorded. |