3fb920e343
Workflow-level permissions: write in a reusable workflow causes startup_failure when calling workflow has default (read-only) permissions. Move write scope to the phpcs job level only — the one job that actually needs it (phpcbf commit-back). All other jobs run with the inherited read scope. Self-test caller (ci-self-test.yml) confirmed clean with no top-level write permission declared — job-level override in the reusable workflow is sufficient. Confirmed via bisect: ci-bisect.yml (workflow-level write) startup_failed; ci-minimal.yml (no write needed) succeeded; ci-bisect-caller with permissions: write added succeeded. Job-level approach is the correct pattern. Agent-Session: claude/reusable-ci-20260616
24 lines
664 B
YAML
24 lines
664 B
YAML
# Self-test: exercises the reusable ci.yml on this repo itself.
|
|
# Uses tests: none (peptide-e2e is a Playwright/Node repo, no PHP suite).
|
|
# phpcs_autofix: false avoids needing contents: write at the caller level
|
|
# (the phpcs job in ci.yml has its own job-level write permission for phpcbf).
|
|
# Purpose: smoke-check that the reusable workflow skeleton runs without errors.
|
|
|
|
name: CI Self-Test (reusable ci.yml)
|
|
|
|
on:
|
|
push:
|
|
branches: [main, 'claude/**']
|
|
pull_request:
|
|
branches: [main]
|
|
|
|
jobs:
|
|
ci:
|
|
uses: ./.github/workflows/ci.yml
|
|
with:
|
|
tests: none
|
|
enforce_300: false
|
|
has_js: false
|
|
phpcs_autofix: false
|
|
secrets: inherit
|