Skip to content

fix(release): let the release workflow inherit the caller's permissions #64

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We鈥檒l occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
unional merged 1 commit into from
Oct 11, 2026
Merged

fix(release): let the release workflow inherit the caller's permissions #64

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 9 additions & 11 deletions .github/workflows/pnpm-release-changeset-oidc.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ name: pnpm-release-changeset-oidc
#
# Differences from that workflow:
# - No CI_GITHUB_TOKEN. Checkout and changesets/action both use the built-in
# GITHUB_TOKEN with elevated `permissions`. GitHub starts no workflows for events
# GITHUB_TOKEN with the caller's grant. GitHub starts no workflows for events
# that token causes, so opening or pushing the "version packages" PR does not run
# the caller's `on: pull_request` CI, and a ruleset that requires its checks leaves
# the PR blocked. workflow_dispatch is the one event GITHUB_TOKEN may trigger, so
Expand All @@ -14,8 +14,14 @@ name: pnpm-release-changeset-oidc
# means a long-lived private key in org secrets; this needs no stored secret.
#
# The caller must:
# - grant `actions: write` (on top of `contents: write`, `pull-requests: write`
# and `id-token: write`) to the job that calls this workflow, for the dispatch;
# - grant `id-token: write`, `contents: write` and `pull-requests: write` to
# the job that calls this workflow, plus `actions: write` for the dispatch.
# This workflow declares no `permissions:` of its own, so the caller's grant
# passes through unchanged. A block here would cap the token: every scope it
# did not list, `actions` included, would drop to `none`, and the dispatch
# would fail with 403 even when the caller grants `actions: write`. Listing
# `actions: write` here instead would break every caller that does not grant
# it, since a called workflow may not request more than its caller grants;
# - list `workflow_dispatch:` in the `on:` block of its CI workflow
# (`ci-workflow`, default pull-request.yml). Without it the dispatch fails; the
# release still succeeds, but with a warning and a PR that has no checks.
Expand Down Expand Up @@ -59,14 +65,6 @@ on:
description: 'Whether the release was published'
value: ${{ jobs.release.outputs.published }}

permissions:
# Mints the OIDC token npm exchanges for short-lived publish credentials.
id-token: write
# Lets changesets/action push the version branch and tags.
contents: write
# Lets changesets/action open the "version packages" PR.
pull-requests: write

concurrency: ${{ github.workflow }}-${{ github.ref }}

jobs:
Expand Down