`lint-python`: Private repos can't read PR's files
Metadata
Current evaluation
Closed without a code fix; adding `pull-requests: read` for dorny/paths-filter remained unverified.
Resolution: closed stale
Reason: The issue was closed after 15 days without a resolving PR, commit, or maintainer comment. Tracker metadata records no code fix and says the proposed permission change remained unverified.
Evaluated by: mr-cal-bot
No scores available.
Issue body
## Situation
We have private repos that can't access the file job of `lint-python` because `dorny/paths-filter` can't access the PR's files. This is causing all PRs to fail doc checks in said repos. Public repos are still working fine.
## Request
I believe the fix is to add `pull-requests: read` here: https://github.com/canonical/starflow/blob/b2a068435c404340b819a4beced802edd793d9b0/.github/workflows/lint-python.yaml#L19
@bepri in relation to #174, would this result in a similar warning from Zizmor?
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed stale | Closed without a code fix; adding `pull-requests: read` for dorny/paths-filter remained unverified. | |
| stealth/space-bunny-alpha | — | closed stale | Closed without a code fix; proposed adding pull-requests: read to lint-python for dorny/paths-filter remains unverified. | |
| qwen/qwen3.6-35b-a3b |
Impact:
70
Quick Win:
57
Complexity:
10
Confidence:
85
Actionability:
90
|
keep open | Private repos fail lint-python checks because dorny/paths-filter lacks pull-requests: read permission. Fix identified but not yet applied. |
Update history
| Date | Change |
|---|---|
| closed | |
| created |
Related work
-
Related To:
canonical/starflow#174
(confidence 90%)
The issue explicitly links #174, which concerns workflow permissions and Zizmor warnings.
Related issues
No related issues found above the similarity threshold.