From 9fda3c489b94549d22951c2929a410daa545e62a Mon Sep 17 00:00:00 2001 From: "Asad Iqbal (Saadi)" Date: Thu, 18 Jun 2026 13:46:30 +0500 Subject: [PATCH 1/4] test: PII gate smoke check (.github#62) --- PII_GATE_SMOKE.md | 4 ++++ 1 file changed, 4 insertions(+) create mode 100644 PII_GATE_SMOKE.md diff --git a/PII_GATE_SMOKE.md b/PII_GATE_SMOKE.md new file mode 100644 index 00000000..dbd88bf6 --- /dev/null +++ b/PII_GATE_SMOKE.md @@ -0,0 +1,4 @@ +# PII gate smoke check + +Verifies the public-pii-gate reusable workflow resolves from @main after publishing. +Safe to delete. Tracking: tracebloc/.github#62 From 1dcf11c365fb28e4b011a69691425441e34c7ba3 Mon Sep 17 00:00:00 2001 From: "Asad Iqbal (Saadi)" Date: Thu, 18 Jun 2026 13:49:27 +0500 Subject: [PATCH 2/4] test: re-trigger PII gate (synchronize) --- PII_GATE_SMOKE.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/PII_GATE_SMOKE.md b/PII_GATE_SMOKE.md index dbd88bf6..96d5e4fb 100644 --- a/PII_GATE_SMOKE.md +++ b/PII_GATE_SMOKE.md @@ -2,3 +2,5 @@ Verifies the public-pii-gate reusable workflow resolves from @main after publishing. Safe to delete. Tracking: tracebloc/.github#62 + +(synchronize trigger to force a fresh gate run post-publish) From fcf294ad2152225f5230b093099cb5cd8c64dd84 Mon Sep 17 00:00:00 2001 From: "Asad Iqbal (Saadi)" Date: Thu, 18 Jun 2026 13:56:08 +0500 Subject: [PATCH 3/4] test: grant caller permissions to fix PII gate startup (#62) --- .github/workflows/public-pii-gate-caller.yml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/.github/workflows/public-pii-gate-caller.yml b/.github/workflows/public-pii-gate-caller.yml index 4af60162..16faaef2 100644 --- a/.github/workflows/public-pii-gate-caller.yml +++ b/.github/workflows/public-pii-gate-caller.yml @@ -8,6 +8,14 @@ on: pull_request: types: [opened, edited, reopened, synchronize, labeled, unlabeled] +# Grant the scopes the reusable workflow needs. Required because the repo's +# default workflow token permission is "read" (contents only); without this +# the called workflow's pull-requests:read request exceeds the caller's grant +# and the run fails at startup with no jobs. +permissions: + contents: read + pull-requests: read + jobs: pii-gate: uses: tracebloc/.github/.github/workflows/public-pii-gate.yml@main From b27747b11ec54e15a94be7b6d50c8bb4a9efd39f Mon Sep 17 00:00:00 2001 From: "Asad Iqbal (Saadi)" Date: Thu, 18 Jun 2026 13:58:40 +0500 Subject: [PATCH 4/4] test: minimal caller against fix branch (#62) --- .github/workflows/public-pii-gate-caller.yml | 10 +--------- 1 file changed, 1 insertion(+), 9 deletions(-) diff --git a/.github/workflows/public-pii-gate-caller.yml b/.github/workflows/public-pii-gate-caller.yml index 16faaef2..499add13 100644 --- a/.github/workflows/public-pii-gate-caller.yml +++ b/.github/workflows/public-pii-gate-caller.yml @@ -8,15 +8,7 @@ on: pull_request: types: [opened, edited, reopened, synchronize, labeled, unlabeled] -# Grant the scopes the reusable workflow needs. Required because the repo's -# default workflow token permission is "read" (contents only); without this -# the called workflow's pull-requests:read request exceeds the caller's grant -# and the run fails at startup with no jobs. -permissions: - contents: read - pull-requests: read - jobs: pii-gate: - uses: tracebloc/.github/.github/workflows/public-pii-gate.yml@main + uses: tracebloc/.github/.github/workflows/public-pii-gate.yml@fix/pii-gate-token-perms secrets: inherit