d0f8c1d65c
GitHub Actions permission model for reusable workflows: callers must declare at least the permission level that any job in the called workflow requests. Since the phpcs job declares 'permissions: contents: write' (for phpcbf commit-back), all callers must include 'permissions: contents: write' at their workflow level. Changes: - ci.yml: remove top-level permissions block (was: contents: read); phpcs job already has job-level contents: write. Docblock now explains the caller requirement clearly. - ci-self-test.yml: add 'permissions: contents: write' at workflow level. - README.md: adoption snippet now includes the required permissions block. - Remove diagnostic bisect/minimal test workflows (used to identify the root cause of startup_failure; finding: job-level write in reusable workflow requires caller to declare write at workflow level). Confirmed: ci-bisect-caller with permissions: contents: write = SUCCESS. Confirmed: actionlint 1.7.4 + yamllint 1.38.0 both clean. Agent-Session: claude/reusable-ci-20260616
28 lines
857 B
YAML
28 lines
857 B
YAML
# Self-test: exercises the reusable ci.yml on this repo itself.
|
|
# Uses tests: none (peptide-e2e is a Playwright/Node repo, no PHP suite).
|
|
# permissions: contents: write is required at the caller level — any caller of
|
|
# ci.yml must declare this so the phpcs job can commit phpcbf fixes back to the
|
|
# PR branch. Even with phpcs_autofix: false here, the permission must be declared
|
|
# for the reusable workflow to pass GH's startup permission-escalation check.
|
|
|
|
name: CI Self-Test (reusable ci.yml)
|
|
|
|
on:
|
|
push:
|
|
branches: [main, 'claude/**']
|
|
pull_request:
|
|
branches: [main]
|
|
|
|
permissions:
|
|
contents: write # required: called ci.yml phpcs job declares job-level write for phpcbf
|
|
|
|
jobs:
|
|
ci:
|
|
uses: ./.github/workflows/ci.yml
|
|
with:
|
|
tests: none
|
|
enforce_300: false
|
|
has_js: false
|
|
phpcs_autofix: false
|
|
secrets: inherit
|