fix(ci): remove job-level permissions conflicting with reusable workflow call - #49
Conversation
…low call GitHub does not allow jobs.<id>.permissions and jobs.<id>.uses together. The reusable workflow (release-changesets.yml) declares its own permissions internally. Removing the redundant job-level block unblocks the release workflow.
|
There was a problem hiding this comment.
Pull request overview
Fixes the failing Release GitHub Actions workflow by removing an invalid job configuration (calling a reusable workflow while also defining job-level permissions).
Changes:
- Removes
jobs.release.permissionsfrom.github/workflows/release.ymlto avoid thepermissions+usesconflict on the same job.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| release: | ||
| if: github.event.workflow_run.conclusion == 'success' | ||
| name: Release | ||
| permissions: | ||
| attestations: write # to create attestations (changesets/action) | ||
| contents: write # to create the release (changesets/action) | ||
| id-token: write # for npm provenance verification (changesets/action) | ||
| issues: write # to post issue comments (changesets/action) | ||
| pull-requests: write # to create the pull request (changesets/action) | ||
| uses: benhigham/.github/.github/workflows/release-changesets.yml@main |
There was a problem hiding this comment.
With the job-level permissions removed, this workflow now relies on the workflow-level permissions: {} (line 14), which sets the caller’s GITHUB_TOKEN permissions to none. For reusable workflows, the called workflow’s token permissions are constrained by the caller, so release-changesets.yml may not be able to perform actions like creating releases/PRs or posting comments. Consider setting the required permissions at the workflow level here (since job-level permissions can’t be used with jobs.<id>.uses), or remove/relax permissions: {} if you intend the called workflow to control permissions.
|
Fixed — moved permissions to workflow level. Reusable workflows inherit the calling workflow's permissions, so |
Problem
The Release workflow has been failing since 2026-03-05 with "This run likely failed because of a workflow file issue."
Root cause: GitHub Actions does not allow
jobs.<id>.permissionsandjobs.<id>.useson the same job. Both were set — thepermissionsblock was redundant becauserelease-changesets.yml(the reusable workflow) already declares its own internal permissions.Fix
permissionsto the workflow level. The reusable workflow's job-level permissions can only use permissions that the caller grants (same or more restrictive), so the caller must provide them at the workflow level.issues: write— confirmed not needed after auditing alloctokitAPI calls inchangesets/actionsource (repos.createRelease,pulls.list,pulls.create,pulls.update— zero issues API usage).attestations: writeandid-token: writeto npm provenance (notchangesets/action), correct "verification" to "generation", and note thatpull-requests: writecovers both create and update.Impact
Unblocks the release of
v0.2.0, which has been onmain(changeset merged, package.json bumped) but unpublished since 2026-03-06.