fix(ci): grant contents:read so the grade workflow stops failing at startup#9
Merged
Merged
Conversation
…tartup The grade job listed only issues:write + pull-requests:write. A permissions block forces every unlisted scope to `none`, so this granted contents:none. Since 2026-05-03 the reusable HackYourFuture/github-actions auto-grade.yml requests contents:read (actions/checkout), and GitHub rejects a reusable workflow whose job needs more permission than the caller grants — at load time, which is why every run shows startup_failure with 0 jobs. Adding contents:read matches the working c55-data-week-6 caller. Note: this PR's own run still uses the base-branch (broken) workflow because pull_request_target evaluates the workflow from the base ref, so the check here will still startup_failure until this merges to main. New/updated PRs after merge will grade correctly. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Every
Grade Assignmentrun on this repo showsstartup_failure(0s, no jobs) — the autograder has never actually run, on any student PR.Root cause: the
gradejob in.github/workflows/grade-assignment.ymlsetsA
permissions:block forces every scope you don't list tonone, so this grantscontents: none. The reusable workflow it calls —HackYourFuture/github-actions/.github/workflows/auto-grade.yml@main— has its job requestcontents: read(foractions/checkout). GitHub rejects any reusable workflow whose job needs more permission than the caller grants, and it does so at workflow-load time →startup_failurewith zero jobs.Evidence
contents: readon 2026-05-03. Every reusable-style run before that date succeeded; every one after fails withstartup_failure.c55-data-week-6caller already grantscontents: readalongside the other two scopes.Fix
Add one line —
contents: read— to thegradejob'spermissions, matchingc55-data-week-6.Note on this PR's own check
grade-assignment.ymlruns onpull_request_target, which evaluates the workflow from the base branch. So this PR's own Grade Assignment run will stillstartup_failureuntil it merges. After merge, subsequent PR events (and re-triggered PRs) grade correctly.Wider scope
The same regression hits every reusable-style caller that omits
contents: read. Also confirmed failing:c55-backend-week-9,c55-backend-week-6. The one-liner should be applied to those too, and to the template/generator these assignment repos are created from, so new repos aren't born broken.🤖 Generated with Claude Code