From 44d7406266e403e013efe119fcf3540d0bed6b5e Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 4 Jun 2026 11:39:28 +0000 Subject: [PATCH] ci: grant pull-requests:write to release job for nested propose workflow The release job calls release-shared.yml, which calls propose-release-notes.yml whose 'propose' job requests pull-requests: write. For nested reusable workflows a called job's permissions cannot exceed those granted to the calling job, so the release job must declare pull-requests: write or the run fails validation with 'pull-requests: none'. --- .github/workflows/release.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 3b8bb9a099..fe7dc96ac7 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -189,9 +189,15 @@ jobs: name: Release needs: plan if: needs.plan.outputs.should_release == 'true' + # pull-requests: write is required by the nested propose-release-notes + # workflow (release-shared.yml -> propose-release-notes.yml). For nested + # reusable workflows, a called job's permissions can't exceed those granted + # to the calling job, so this must be declared here even though the propose + # job uses an App token for its actual PR creation. permissions: contents: write id-token: write + pull-requests: write uses: ./.github/workflows/release-shared.yml with: version: ${{ needs.plan.outputs.version }}