fix(workflow): fix release.yml

[chrisleekr]

Summary

The release.yml workflow was failing at startup with a GitHub Actions validation error. The reusable docker-build.yml workflow requests attestations: read at the workflow level and attestations: write in the merge job, but the calling docker job in release.yml had no attestations permission declared — defaulting it to none. GitHub blocks any nested workflow from elevating permissions beyond what the caller grants.

[Invalid workflow file: .github/workflows/release.yml#L109](https://github.com/chrisleekr/github-app-playground/actions/runs/25274688103/workflow)
The workflow is not valid. .github/workflows/release.yml (Line: 109, Col: 3): Error calling workflow 'chrisleekr/github-app-playground/.github/workflows/docker-build.yml@3b6036cffa5b73aefcd8fb0b788bb526ac401df3'. The workflow is requesting 'attestations: read', but is only allowed 'attestations: none'. .github/workflows/release.yml (Line: 109, Col: 3): Error calling workflow 'chrisleekr/github-app-playground/.github/workflows/docker-build.yml@3b6036cffa5b73aefcd8fb0b788bb526ac401df3'. The nested job 'merge' is requesting 'attestations: write', but is only allowed 'attestations: none'.

Why

GitHub Actions enforces that GITHUB_TOKEN permissions can only be maintained or reduced through a reusable workflow chain — never elevated. Granting attestations: write at the caller level satisfies both the read and write scopes required by the nested docker-build.yml jobs.

Diagram

Changes

• Add attestations: write to the top-level permissions block in .github/workflows/release.yml
• Add attestations: write to the top-level permissions block in .github/workflows/dev-release.yml

Related Issues

• Closes #(issue number)

Test plan

• Tested locally
• Added/updated tests
• All existing tests pass

Summary by CodeRabbit

• Chores
  • Updated GitHub Actions workflow permissions to enhance the release process infrastructure.

[coderabbitai]

📝 Walkthrough

Walkthrough

The PR adds attestations: write permission to the GitHub Actions release workflow, enabling the workflow to create build attestations. This is a single-line configuration change to expand the workflow's existing permissions.

Changes

Release Workflow Permissions

Layer / File(s)	Summary
Workflow Configuration .github/workflows/release.yml	attestations: write permission added to the workflow-level permissions block alongside existing contents, security-events, and id-token permissions.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Suggested labels

type: fix 🐞

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Title check	❓ Inconclusive	The title 'fix(workflow): fix release.yml' is vague and redundant—it simply repeats 'fix' without specifying what the actual problem is, such as the specific permission issue being corrected.	Revise the title to be more specific about the actual change, such as 'fix(workflow): add attestations write permission to release.yml' or 'fix(release.yml): grant attestations permission for workflow calls'.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[Copilot]

Pull request overview

This PR updates the manual production release workflow to address the reusable Docker build workflow’s new attestation permission requirements. In the broader codebase, release.yml orchestrates CI, semantic-release, and the reusable docker-build.yml workflow for production releases.

Changes:

• Add attestations: write to the top-level permissions in .github/workflows/release.yml.
• Keep the production release workflow aligned with the nested Docker image publish/attestation flow.
• Address the GitHub Actions validation failure reported for the production release workflow.

[chrisleekr]

🎉 This PR is included in version 1.9.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀