ci: Allow QA reusable workflows to read pull request metadata
Metadata
Current evaluation
The QA permissions fix was approved but closed unmerged after the Conventional Commits policy check failed; no resolving commit or replacement was recorded.
Resolution: closed stale
Reason: PR #446 received two approvals, but its only failing check was the Conventional Commits policy and it has no recorded merge, commit, replacement, or closing maintainer comment. The proposed workflow fix was therefore abandoned.
Evaluated by: mr-cal-bot
No scores available.
Issue body
The QA workflow was failing at workflow compilation time because the called Starflow lint workflow requests `pull-requests: read`, but the caller did not grant that permission. As a result, QA could not instantiate any jobs for PR-triggered runs.
- **Root cause**
- `qa.yaml` invokes reusable workflows from `canonical/starflow`.
- The called lint workflow contains a nested job that explicitly requests `pull-requests: read`.
- GitHub rejects the workflow when the caller only permits `pull-requests: none`.
- **Change**
- Added explicit top-level permissions to `/.github/workflows/qa.yaml` so the reusable workflows can request the read-only scopes they need:
- `actions: read`
- `contents: read`
- `pull-requests: read`
- **Effect**
- Restores QA workflow validity for PR runs.
- Keeps the permission set read-only and limited to the scopes required by the reusable Starflow workflows.
```yaml
permissions:
actions: read
contents: read
pull-requests: read
```
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed stale | The QA permissions fix was approved but closed unmerged after the Conventional Commits policy check failed; no resolving commit or replacement was recorded. | |
| stealth/space-bunny-alpha | — | closed stale | Closed without a recorded merge. The +5-line QA permissions fix was approved, but the Conventional Commits check failed; no resolving PR, commit, or replacement is recorded. | |
| qwen/qwen3.6-35b-a3b |
Impact:
50
Quick Win:
36
Complexity:
10
Confidence:
85
Actionability:
80
|
needs review | Adds read permissions to qa.yaml to fix CI workflow compilation errors when calling Starflow reusable workflows. Approved, CI mostly passing. |
Update history
| Date | Change |
|---|---|
| closed | |
| updated | |
| created |
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #1741 ci: Add missing permissions to QA lint workflow | craft-parts | closed | Closed unmerged after the equivalent QA workflow permission fix landed in commit 585b7237. | |
| #216 ci: Add missing permissions to QA lint workflow | craft-grammar | closed | PR #216 (lengau) added explicit contents/pull-requests read permissions to the QA lint job and was approved, but the lint / files check failed; the PR was closed unmerged after ~8 days with no resolution recorded. | |
| #1731 ci: fix permissions for QA workflow | craft-parts | closed | Closed unmerged after approval: #1731 proposed explicit read permissions for incoming Starflow QA jobs, but no resolving commit landed and remaining CI checks never completed. | |
| #600 ci: Add missing permissions to QA lint workflow | starbase | closed | PR #600 was closed unmerged despite all CI checks passing; no merge commit or recorded replacement was found. | |
| #557 ci: set read permissions for qa workflow | starbase | merged | Merged PR #557 as commit cd8d487, granting the QA workflow read-only contents and pull-request permissions so paths-filter can access GitHub APIs. | |
| #194 ci: Set workflow-level read permissions for QA workflow | debcraft | merged | PR #194 merged: added workflow-level read permissions (actions, contents, pull-requests) to .github/workflows/qa.yaml and removed lint job-level overrides, fixing Starflow reusable workflow compilation on PRs. | |
| #6438 ci: Add missing permissions to QA lint workflow | snapcraft | closed | PR closed unmerged by lengau as redundant: the QA workflow (.github/workflows/qa.yaml) already grants workflow-level contents/pull-requests read permissions on main, so job-level permissions in the lint job were unnecessary. | |
| #1191 ci: Fix QA workflow permissions for reusable lint job | craft-application | closed | PR #1191 was approved but closed unmerged; commit 5353ad50 records its lint permission change, while lint/files and title-policy checks still failed. | |
| #257 ci: Set workflow-level read permissions for QA workflow | craft-archives | merged | PR #257 by lengau merged as commit 7179169: moved QA workflow permissions to workflow-level read scopes (actions, contents, pull-requests) and dropped job-local lint overrides, fixing Starflow reusable workflow compilation on PRs. | |
| #1375 ci: Add missing permissions to QA lint workflow | rockcraft | closed | PR #1375 (rockcraft) adding job-level contents/pull-requests read permissions to the QA lint workflow was closed unmerged by @lengau as redundant — the workflow's existing workflow-level permissions were already sufficient. |