ci: set read permissions for qa workflow
Metadata
Current evaluation
Merged PR #557 as commit cd8d487, granting the QA workflow read-only contents and pull-request permissions so paths-filter can access GitHub APIs.
Resolution: closed resolved
Reason: Merged into main as cd8d487, adding contents: read and pull-requests: read workflow permissions. Two reviewers approved it, and all CI checks passed.
Evaluated by: mr-cal-bot
No scores available.
Issue body
External projects don't need this, but internal projects do. They can't run actions like paths-filter that rely on the GitHub API without these explicit permissions.
Our craft actions aren't affected by this because they don't use the API.
---
- [x] I've followed the [contribution guidelines](https://github.com/canonical/starbase/blob/main/CONTRIBUTING.md).
- [x] I've signed the [CLA](http://www.ubuntu.com/legal/contributors/).
- [x] I've successfully run `make lint && make test`.
- [ ] I've added or updated any relevant documentation.
- [ ] In documents I changed, I [added a meta description](https://canonical-starflow.readthedocs-hosted.com/how-to/add-a-page-meta-description/) if one was missing.
- [ ] I've updated the relevant release notes.
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Merged PR #557 as commit cd8d487, granting the QA workflow read-only contents and pull-request permissions so paths-filter can access GitHub APIs. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged PR #557 (commit cd8d487) added explicit read permissions to the QA workflow, enabling internal projects to use API-dependent actions such as paths-filter. | |
| qwen/qwen3.6-35b-a3b | — | — | Merged updates granting explicit read permissions to the QA workflow. This allows internal projects to run GitHub API-dependent actions like paths-filter. Approved by two reviewers with all CI checks passing. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged explicit read permissions into the CI QA workflow to enable GitHub API-dependent actions like paths-filter for internal projects. External projects remain unaffected. |
Update history
No update history recorded yet.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #1016 ci: Set workflow-level read permissions for QA workflow | craft-providers | merged | Merged to main via commit a533e67 "ci: Add missing permissions to QA workflow (#1016)", adding workflow-level read permissions (actions, contents, pull-requests) to .github/workflows/qa.yaml. | |
| #194 ci: Set workflow-level read permissions for QA workflow | debcraft | merged | PR #194 merged: added workflow-level read permissions (actions, contents, pull-requests) to .github/workflows/qa.yaml and removed lint job-level overrides, fixing Starflow reusable workflow compilation on PRs. | |
| #428 ci: Set workflow-level read permissions for QA workflow | craft-store | merged | Merged as commit 4aabe63: .github/workflows/qa.yaml now sets workflow-level read permissions (actions, contents, pull-requests) and drops job-local lint overrides, fixing Starflow QA workflow failures on PRs. | |
| #487 ci: Set workflow-level read permissions for QA workflow | craft-cli | merged | PR #487 merged: added workflow-level read permissions (actions, contents, pull-requests) to .github/workflows/qa.yaml so canonical/starflow reusable workflows compile; approved with all CI checks green (+5/-0 lines, 1 file). | |
| #94 ci: Set workflow-level read permissions for QA workflow | craft-artifacts | merged | Merged PR #94 as df2d092, adding workflow-level read permissions for actions, contents, and pull requests so QA's Starflow reusable workflows can access required metadata. | |
| #257 ci: Set workflow-level read permissions for QA workflow | craft-archives | merged | PR #257 by lengau merged as commit 7179169: moved QA workflow permissions to workflow-level read scopes (actions, contents, pull-requests) and dropped job-local lint overrides, fixing Starflow reusable workflow compilation on PRs. | |
| #1371 ci: add explicit permissions on QA workflow | rockcraft | closed | Merged explicit read permissions for actions, contents, and pull requests into the QA workflow in commit 559eb218, enabling Starflow path-filter jobs. | |
| #446 ci: Allow QA reusable workflows to read pull request metadata | imagecraft | closed | The QA permissions fix was approved but closed unmerged after the Conventional Commits policy check failed; no resolving commit or replacement was recorded. | |
| #1731 ci: fix permissions for QA workflow | craft-parts | closed | Closed unmerged after approval: #1731 proposed explicit read permissions for incoming Starflow QA jobs, but no resolving commit landed and remaining CI checks never completed. | |
| #1375 ci: Add missing permissions to QA lint workflow | rockcraft | closed | PR #1375 (rockcraft) adding job-level contents/pull-requests read permissions to the QA lint workflow was closed unmerged by @lengau as redundant — the workflow's existing workflow-level permissions were already sufficient. |