ci: set read permissions for qa workflow
Metadata
Current evaluation
Merged updates granting explicit read permissions to the QA workflow. This allows internal projects to run GitHub API-dependent actions like paths-filter. Approved by two reviewers with all CI checks passing.
Suggested action: —
No scores available.
Issue body
External projects don't need this, but internal projects do. They can't run actions like paths-filter that rely on the GitHub API without these explicit permissions.
Our craft actions aren't affected by this because they don't use the API.
---
- [x] I've followed the [contribution guidelines](https://github.com/canonical/starbase/blob/main/CONTRIBUTING.md).
- [x] I've signed the [CLA](http://www.ubuntu.com/legal/contributors/).
- [x] I've successfully run `make lint && make test`.
- [ ] I've added or updated any relevant documentation.
- [ ] In documents I changed, I [added a meta description](https://canonical-starflow.readthedocs-hosted.com/how-to/add-a-page-meta-description/) if one was missing.
- [ ] I've updated the relevant release notes.
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| qwen/qwen3.6-35b-a3b | — | — | Merged updates granting explicit read permissions to the QA workflow. This allows internal projects to run GitHub API-dependent actions like paths-filter. Approved by two reviewers with all CI checks passing. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged explicit read permissions into the CI QA workflow to enable GitHub API-dependent actions like paths-filter for internal projects. External projects remain unaffected. |
Update history
No update history recorded yet.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #477 ci: add actions: read permission to policy job | craft-cli | merged | Merged a single-line update granting actions: read permissions to the GitHub Actions policy job. This prevents workflow failures by aligning with required upstream permissions. Approved and passed all CI checks. | |
| #1218 ci: add checkout step to qa workflow filter | rockcraft | merged | Merged a fix for the QA workflow failing on push events by adding a required checkout step to the paths-filter action. Approved and merged after CI checks passed. | |
| #2701 ci: filter in qa workflow | charmcraft | merged | Merged. Adds a filter to the QA workflow and passes it to the lint workflow. Approved by two reviewers. Tests are intentionally skipped to be verified before merge. | |
| #1131 ci: skip QA and Spread workflows for security-scanner-only PRs | craft-application | merged | Merged. Added paths-ignore filters to qa.yaml and spread.yaml to skip QA and Spread CI pipelines for PRs only modifying security scanner configurations. Approved by two reviewers and successfully merged. | |
| #2710 ci: fix qa workflow conditional | charmcraft | merged | Merged a fix correcting a typo in the CI QA workflow conditional that was locking the pipeline. Approved by two reviewers and passed CI checks. Restores workflow execution, with full resolution pending upstream starflow PR #146. | |
| #546 docs: add filter to qa workflow | starbase | merged | Merged workflow updates adding conditionals to skip unnecessary documentation checks. The fork test job hanging was clarified as a missing self-hosted runner tag configuration issue. Approved by reviewers and merged after CI validation. | |
| #359 ci: use hosted runners for QA | craft-cli | merged | Merged update to CI configuration switching QA workflows from self-hosted to GitHub-hosted runners. Enables non-x86 architecture testing. Approved by two reviewers with all CI checks passing. Changes modify one file. | |
| #393 ci: pass staging username via vars in qa workflow | craft-store | merged | Merged. Refactors the QA workflow to pass the staging username via variables instead of secrets, reserving secret slots for passwords. Approved by one reviewer and passed all CI checks. | |
| #160 ci: add path filter to qa workflow, make jobs conditional | debcraft | merged | Merged: added a path filter to the QA workflow to conditionally run lint and test jobs. Approved, passed CI, and verified to skip for docs-only changes. Resolves CRAFT-5161. |