test-python.yaml needs actions:read permission, but will break downstream

Metadata

Project: starflow
Number: #174
Type: issue
State: open
Author: bepri
Labels: —
Created: 2026-09-14 06:01 PM UTC
Updated: 2026-09-14 06:01 PM UTC
Closed: —

Current evaluation

Zizmor flags test-python.yaml as excessive-permissions: it calls `gh api .../actions/jobs` (needs actions:read) but declares no permissions block. Adding it would break all downstream callers, so it awaits a cross-repo rollout.

Suggested action: keep open

Reason: Maintainer-authored (bepri) and precisely scoped: the author identified the exact cause ('uses `gh api repos/.../actions/jobs/...` ... requires the `actions: read` permission, but the workflow doesn't declare a `permissions:` block'), the exact fix, and the exact blocker ('adding this would make all of them turn red' since no caller grants `actions: read`). This is a valid finding, not a stale or support request, and the remaining path is a real cross-repo rollout decision — not a missing-reproducer problem, so it should stay open rather than be re-triaged. I confirmed the `gh api`/jobs usage pattern is consistent with the file's caller-job-name resolution step, but could not inspect commit history or the caller repos (no pinned SHA available), which caps confidence.

Evaluated by: mr-cal-bot

Impact: 30 Quick Win: 11 Complexity: 55 Confidence: 72 Actionability: 78

Issue body

## Problem `test-python.yaml` uses `gh api repos/.../actions/jobs/...` to resolve the caller job name. This requires the `actions: read` permission, but the workflow doesn't declare a `permissions:` block. Zizmor flags this as `excessive-permissions` (default permissions are too broad). ## Why not fix it now Adding `permissions: { contents: read, actions: read }` to the reusable workflow will cause it to fail on any caller that doesn't also grant `actions: read`. Currently, none of our other repos pass `actions: read`, so adding this would make all of them turn red

Evaluation history

Date	Model	Scores	Action	Summary
2026-10-02 08:42 PM UTC	stealth/space-bunny-alpha	Impact: 30 Quick Win: 11 Complexity: 55 Confidence: 72 Actionability: 78	keep open	Zizmor flags test-python.yaml as excessive-permissions: it calls `gh api .../actions/jobs` (needs actions:read) but declares no permissions block. Adding it would break all downstream callers, so it awaits a cross-repo rollout.
2026-10-02 08:42 PM UTC	stealth/space-bunny-alpha	Impact: 32 Quick Win: 8 Complexity: 55 Confidence: 62 Actionability: 55	needs triage	Reusable test-python.yaml calls `gh api repos/.../actions/jobs/...` without declaring a permissions block, flagged by zizmor as excessive-permissions; author notes adding `actions: read` would turn red all downstream repos that don't grant it. Open, untriaged, no comments.
2026-09-24 09:29 PM UTC	stealth/space-bunny-alpha	Impact: 42 Quick Win: 13 Complexity: 52 Confidence: 86 Actionability: 66	needs triage	Zizmor flags excessive permissions in reusable test-python; declaring actions:read is blocked by downstream callers that need coordinated permission updates.
2026-09-14 06:08 PM UTC	qwen/qwen3.6-35b-a3b	Impact: 50 Quick Win: 30 Staleness: 0 Complexity: 40 Confidence: 75 Support Request: 10	needs triage	test-python.yaml uses gh api requiring actions:read permission but doesn't declare it, flagged by zizmor as excessive-permissions. Fix deferred due to downstream breakage.

Update history

Date	Change
2026-09-14 06:01 PM UTC	created

Related issues

No related issues found above the similarity threshold.