release: grant security-events write to lint job - #594
Merged
Merged
Conversation
The release workflow's lint job calls .github/workflows/lint.yml, which requests security-events: write to upload SARIF to code scanning. The release workflow only granted contents: read and actions: write at the workflow level, so GitHub Actions rejected the run at startup with: Error calling workflow '.../lint.yml@...'. The workflow is requesting 'security-events: write', but is only allowed 'security-events: none'. Reusable workflows cannot elevate permissions beyond what the caller grants, so this failed before any job was scheduled (see run https://github.com/eclipse-score/baselibs/actions/runs/35204834600). Grant the missing permission scoped to just the lint job, matching the existing pattern used for the build-qnx job, so no other release job gains elevated privileges. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
4og
requested review from
antonkri,
arkjedrz,
fbaeuerle and
pawelrutkaq
as code owners
September 17, 2026 12:47
fbaeuerle
approved these changes
Sep 17, 2026
github-project-automation
Bot
moved this from In Progress
to On Hold
in BAS - Baselibs FT
fbaeuerle
enabled auto-merge
September 17, 2026 12:49
Contributor
|
Documentation preview for this pull request is available at: |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The manually dispatched
Release v0.2.13workflow failed at startup (no jobs were created): https://github.com/eclipse-score/baselibs/actions/runs/35204834600GitHub Actions reported:
Root cause
.github/workflows/lint.ymlwas updated to requestsecurity-events: write(for SARIF upload to code scanning), but its caller,.github/workflows/release.yml, only grantscontents: readandactions: writeat the workflow level and does not override permissions for thelintjob. Reusable workflows cannot elevate permissions above what the caller grants, so GitHub rejects the entire run before any job is scheduled.Fix
Grant
security-events: write(along withcontents: readandactions: write) scoped to just thelintjob inrelease.yml, matching the existing pattern already used for thebuild-qnxjob. No other release job's permissions change.Verification
gh run viewand the run's HTML error message that this is the exact permission mismatch causing thestartup_failure.bazel run //tools:format.fix -- .github/workflows/release.yml; no additional formatting changes were needed.