peptide-repo/peptide-e2e
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

fix(ci): move permissions: contents: write to phpcs job level

Browse Source 
Workflow-level permissions: write in a reusable workflow causes startup_failure
when calling workflow has default (read-only) permissions. Move write scope to
the phpcs job level only — the one job that actually needs it (phpcbf commit-back).
All other jobs run with the inherited read scope.

Self-test caller (ci-self-test.yml) confirmed clean with no top-level write
permission declared — job-level override in the reusable workflow is sufficient.

Confirmed via bisect: ci-bisect.yml (workflow-level write) startup_failed;
ci-minimal.yml (no write needed) succeeded; ci-bisect-caller with
permissions: write added succeeded. Job-level approach is the correct pattern.

Agent-Session: claude/reusable-ci-20260616
This commit is contained in:
peptiderepo
2026-06-16 11:40:29 +00:00
parent 49daffafb6
commit 3fb920e343
2 changed files with 9 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
.github/workflows/ci-self-test.yml vendored
View File

@@ -1,10 +1,8 @@
# Self-test: exercises the reusable ci.yml on this repo itself.
# Uses tests: none (peptide-e2e is a Playwright/Node repo, no PHP suite).
# Purpose: smoke-check that the reusable workflow parses and the job
# skeleton runs without YAML/startup errors.
#
# Note: uses a relative path (./.github/workflows/ci.yml) — the correct
# form for same-repo reusable workflow calls on PR branches.
# phpcs_autofix: false avoids needing contents: write at the caller level
# (the phpcs job in ci.yml has its own job-level write permission for phpcbf).
# Purpose: smoke-check that the reusable workflow skeleton runs without errors.
name: CI Self-Test (reusable ci.yml)