ci: Add missing permissions to QA lint workflow
Metadata
Current evaluation
PR #1375 (rockcraft) adding job-level contents/pull-requests read permissions to the QA lint workflow was closed unmerged by @lengau as redundant — the workflow's existing workflow-level permissions were already sufficient.
Resolution: closed not a bug
Reason: Maintainer lengau closed the PR with the comment "closed as redundant - workflow-level permissions are fine", and it was never merged. No code change landed, indicating the missing-permission premise was incorrect for the QA workflow as configured.
Evaluated by: mr-cal-bot
No scores available.
Issue body
The QA workflow was invoking the shared lint workflow without the permissions it expects on pull request runs. This updates the lint job to explicitly grant the read access needed for repository contents and PR metadata.
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed not a bug | PR #1375 (rockcraft) adding job-level contents/pull-requests read permissions to the QA lint workflow was closed unmerged by @lengau as redundant — the workflow's existing workflow-level permissions were already sufficient. | |
| stealth/space-bunny-alpha | — | closed not a bug | Closed as redundant: the QA workflow already had sufficient workflow-level permissions, so the proposed pull-request job permissions were unnecessary. | |
| qwen/qwen3.6-35b-a3b |
Impact:
30
Quick Win:
16
Complexity:
10
Confidence:
75
Actionability:
60
|
needs review | Adds explicit permissions (contents, pull-requests, actions: read) to the lint job in qa.yaml to fix reusable workflow invocation on PRs. Clean +3/-0 change, awaiting review. |
Update history
| Date | Change |
|---|---|
| updated | |
| closed | |
| updated | |
| updated | |
| updated | |
| updated | |
| created |
Related work
-
Related To:
canonical/craft-archives#256
(confidence 80%)
Near-identical PR title and outcome; also closed as redundant due to existing workflow-level read permissions.
-
Related To:
canonical/craft-parts#1741
(confidence 72%)
Same 'ci: Add missing permissions to QA lint workflow' title closed without merge in a sibling Canonical repo.
-
Related To:
canonical/craft-application#1191
(confidence 65%)
Related attempt to fix QA workflow permissions for the shared reusable lint job, also closed without merging.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #6438 ci: Add missing permissions to QA lint workflow | snapcraft | closed | PR closed unmerged by lengau as redundant: the QA workflow (.github/workflows/qa.yaml) already grants workflow-level contents/pull-requests read permissions on main, so job-level permissions in the lint job were unnecessary. | |
| #216 ci: Add missing permissions to QA lint workflow | craft-grammar | closed | PR #216 (lengau) added explicit contents/pull-requests read permissions to the QA lint job and was approved, but the lint / files check failed; the PR was closed unmerged after ~8 days with no resolution recorded. | |
| #256 ci: Add missing permissions to QA lint workflow | craft-archives | merged | Job-level lint permissions PR closed as redundant by maintainer lengau: workflow-level read permissions already configured on main; superseded by merged PR #257 setting workflow-level read permissions. | |
| #427 ci: Add missing permissions to QA lint workflow | craft-store | closed | PR #427 (lengau) added job-level contents/pull-requests read permissions to craft-store's QA lint job (+3/-0). All CI checks passed but review stayed pending; closed unmerged in favour of workflow-level fix PR #428. | |
| #1741 ci: Add missing permissions to QA lint workflow | craft-parts | closed | Closed unmerged after the equivalent QA workflow permission fix landed in commit 585b7237. | |
| #600 ci: Add missing permissions to QA lint workflow | starbase | closed | PR #600 was closed unmerged despite all CI checks passing; no merge commit or recorded replacement was found. | |
| #257 ci: Set workflow-level read permissions for QA workflow | craft-archives | merged | PR #257 by lengau merged as commit 7179169: moved QA workflow permissions to workflow-level read scopes (actions, contents, pull-requests) and dropped job-local lint overrides, fixing Starflow reusable workflow compilation on PRs. | |
| #1191 ci: Fix QA workflow permissions for reusable lint job | craft-application | closed | PR #1191 was approved but closed unmerged; commit 5353ad50 records its lint permission change, while lint/files and title-policy checks still failed. | |
| #193 ci: Add missing permissions to QA lint workflow | debcraft | closed | Closed unmerged: all16 CI checks passed (incl. zizmor, lint / files, CLA) but review stayed pending (0 reviewers, 0 comments) and no merge commit or superseding change was recorded. | |
| #194 ci: Set workflow-level read permissions for QA workflow | debcraft | merged | PR #194 merged: added workflow-level read permissions (actions, contents, pull-requests) to .github/workflows/qa.yaml and removed lint job-level overrides, fixing Starflow reusable workflow compilation on PRs. |