fix: grant the attestation permissions release.yml needs - #69
Merged
Conversation
The binaries job added in #68 broke Release Please at startup. release.yml declares id-token: write and attestations: write for build provenance, and a reusable workflow cannot request more than its caller was granted, so the call made GitHub reject the entire workflow file. The only diagnostic offered is "This run likely failed because of a workflow file issue". Grants both to the caller.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The
binariesjob added in #68 broke Release Please at startup.maincurrentlycannot run it at all.
release.ymldeclaresid-token: writeandattestations: writeso tinfoil canattach build provenance attestations to the uploaded archives. A reusable
workflow cannot request more permissions than its caller was granted, and
release-please.ymlgranted onlycontents: writeandpull-requests: write,so GitHub rejected the whole file before any job started.
The only diagnostic GitHub gives is:
No annotation, and the API returns 404 for both annotations and jobs, because no
jobs were ever created. Nothing points at permissions.
Grants both permissions to the caller, which is the narrower fix. The
alternative is
attestations: falsein the:tinfoilconfig, which drops thepermissions from the generated workflow but also drops provenance.
Verified by parsing the workflow and confirming all four jobs still resolve.
Merging this should let Release Please run and open the release PR for #68.