From c31f2b5592acb8810f7afad2c5d3a18fa473ec17 Mon Sep 17 00:00:00 2001 From: Maximilian Date: Mon, 27 Apr 2026 12:33:50 +0200 Subject: [PATCH] ci: grant publish job contents:write for lockfile auto-commit The publish job's 'Commit lockfile (if changed)' step failed with HTTP 403 on git push because the workflow-level permissions block grants only contents:read. Override at the job level so only publish gets write access; other jobs (lint, unit, pipeline, smoke-action) keep the read-only default. Symptom seen post-merge of #85: redis 6.3.0 bundles successfully pushed to GHCR, but the bundles.lock commit could not land on main, leaving the in-tree lockfile out of sync with the GHCR registry. --- .github/workflows/ci.yml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index ff610ff..39c893c 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -229,6 +229,13 @@ jobs: needs: [pipeline, smoke-action] if: github.ref == 'refs/heads/main' runs-on: ubuntu-24.04 + permissions: + # Override the workflow-level contents:read so this job can push + # the bundles.lock auto-update commit back to main. Other jobs keep + # the read-only default — only publish needs write access. + contents: write + packages: write + id-token: write steps: - uses: actions/checkout@v6 with: