fix: allow staging reusable workflow checkout / 允许预发布可复用工作流检出代码

[cquil11]

Summary

• grant the staging caller contents read permission for the reusable ingest job
• allow the called workflow to request its existing contents read permission
• fix the repository_dispatch startup failure that occurred before any staging job ran

Root cause

The top-level staging workflow defaulted all GITHUB_TOKEN permissions to none. Its reusable ingest workflow requests contents read for checkout, but reusable workflows cannot elevate permissions beyond their caller. GitHub therefore rejected the workflow graph with startup_failure.

Validation

• actionlint .github/workflows/stage-results.yml
• git diff --check
• zizmor .github/workflows/stage-results.yml

中文说明

• 为预发布调用方的可复用写入任务授予 contents 读取权限
• 允许被调用工作流申请其已有的 contents 读取权限
• 修复 repository_dispatch 在任何预发布任务启动前出现的 startup_failure

根因是顶层预发布工作流将 GITHUB_TOKEN 权限默认为 none，而可复用写入工作流需要 contents 读取权限来检出代码。可复用工作流不能超出调用方的权限上限，因此 GitHub 在构建工作流任务图时直接拒绝启动。

---

Note

Low Risk
CI-only permission wiring with no application, auth, or data-path changes.

Overview
The staging workflow sets permissions: {} at the top level, so jobs start with no GITHUB_TOKEN scopes. The ingest job invokes reusable ingest-agentic-results.yml, whose ingest job needs contents: read for actions/checkout. Reusable workflows cannot exceed the caller’s permissions, so GitHub rejected the workflow graph with startup_failure before any staging job ran.

This change adds permissions: contents: read on the ingest job in stage-results.yml, matching what the called workflow already requests and unblocking repository_dispatch staging runs.

^{Reviewed by Cursor Bugbot for commit 13f6de3. Bugbot is set up for automated code reviews on this repo. Configure here.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
inferencemax-app	Ready	Preview, Comment	Jul 13, 2026 5:49pm