From 029c090361bbd1ecdd77660afda407cee291f3a9 Mon Sep 17 00:00:00 2001
From: peptiderepo <273788462+peptiderepo@users.noreply.github.com>
Date: Wed, 17 Jun 2026 11:29:02 +0700
Subject: [PATCH] ci: fix deploy.yml permissions and secrets for reusable
 workflow

Deploy workflow must declare `permissions: contents: write` at workflow level
to allow the nested reusable ci.yml (which needs write for phpcbf auto-commit)
to run. Also adds `secrets: inherit` to the ci job so secrets propagate through.

Pre-existing issue introduced during CI standardization (startup_failure root cause).

Agent-Session: fix-e2e-ref-20260617
---
 .github/workflows/deploy.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 0a51319..b1693c2 100755
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -5,7 +5,7 @@ on:
     branches: [ main ]
 
 permissions:
-  contents: read
+  contents: write
 
 concurrency:
   group: deploy-peptide-reconstitution-calculator
@@ -15,6 +15,7 @@ jobs:
   ci:
     name: Pre-deploy CI
     uses: ./.github/workflows/ci.yml
+    secrets: inherit
 
   deploy:
     name: Deploy (shared pipeline)