ci(release): grant contents:read to sync-templates caller job#1095
Conversation
The release workflow uses default-deny (permissions: {}) at the
workflow level. The sync-templates reusable workflow's job requests
contents: read, but a reusable-workflow job cannot exceed the calling
job's permissions. Without an explicit grant on the caller, the
nested job is denied contents: read and the workflow fails to start.
Grants contents: read on the sync-templates caller job so the nested
job is allowed to request it.
|
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ✅ Deployment successful! View logs |
emdash-perf-coordinator | 682e5c2 | May 18 2026, 07:39 PM |
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ✅ Deployment successful! View logs |
emdash-i18n | 682e5c2 | May 18 2026, 07:40 PM |
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ✅ Deployment successful! View logs |
docs | 682e5c2 | May 18 2026, 07:40 PM |
There was a problem hiding this comment.
Pull request overview
Fixes a release workflow startup failure caused by nested job permissions exceeding the caller's. The workflow-level permissions: {} (default-deny) prevented the sync-templates reusable workflow's job (which requests contents: read) from being permitted. This adds an explicit contents: read grant on the caller job.
Changes:
- Grant
contents: readpermission on thesync-templatescaller job inrelease.yml.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
@emdash-cms/admin
@emdash-cms/auth
@emdash-cms/blocks
@emdash-cms/cloudflare
emdash
create-emdash
@emdash-cms/gutenberg-to-portable-text
@emdash-cms/x402
@emdash-cms/plugin-ai-moderation
@emdash-cms/plugin-atproto
@emdash-cms/plugin-audit-log
@emdash-cms/plugin-color
@emdash-cms/plugin-embeds
@emdash-cms/plugin-forms
@emdash-cms/plugin-webhook-notifier
commit: |
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ✅ Deployment successful! View logs |
emdash-demo-cache | 682e5c2 | May 18 2026, 07:41 PM |
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ✅ Deployment successful! View logs |
emdash-playground | 682e5c2 | May 18 2026, 07:42 PM |
What does this PR do?
Fixes the release workflow, which has been failing with a startup error since the merge of #1059:
release.ymlsetspermissions: {}at the workflow level (default-deny). Thesync-templatesreusable workflow's job declarespermissions: contents: read, but a reusable-workflow job cannot exceed the calling job's permissions. Without an explicit grant on the caller, the nested job is denied and the entire workflow fails to start (no jobs run at all).Grants
contents: readon thesync-templatescaller job inrelease.ymlso the nested job is allowed to request it.Example failed run: https://github.com/emdash-cms/emdash/actions/runs/26053444840
Closes #
Type of change
Checklist
pnpm typecheckpasses (n/a, workflow-only change)pnpm lintpasses (n/a, workflow-only change)pnpm testpasses (n/a, workflow-only change)pnpm formathas been run (n/a, YAML)AI-generated code disclosure
Screenshots / test output
n/a -- single workflow YAML change, will be verified by the next push to
main.