Skip to content

Grant the distribute job the permissions it asks for #115

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ralyodio merged 1 commit into from
Sep 24, 2026
Merged

Grant the distribute job the permissions it asks for #115

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,8 +9,14 @@ on:
description: 'Version to release (e.g. 0.1.0)'
required: true

# A called workflow can only ever hold a subset of its caller's permissions, so
# the distribute job's `pull-requests: write` has to be granted here too — it
# opens the PR carrying the refreshed distribution/ manifests. Without this the
# push succeeds and `gh pr create` is denied, which the script swallows, so the
# branch would appear with no PR behind it.
permissions:
contents: write
pull-requests: write

jobs:
# 1) Create the GitHub Release (draft) up front so each per-platform build job
Expand Down
24 changes: 20 additions & 4 deletions scripts/open-distribution-pr.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,13 +37,29 @@ else
git push origin "${BRANCH}"
fi

# `gh pr create` fails if one is already open for the branch, which is fine.
gh pr create \
# An already-open PR for this branch is fine and expected on a re-run. Anything
# else — a denied token, a missing base — is a real failure and must not be
# swallowed: a silent success here is precisely how this pipeline went three
# months looking healthy while publishing nothing.
set +e
OUT="$(gh pr create \
--base main \
--head "${BRANCH}" \
--title "chore(distribution): refresh manifests for v${VERSION}" \
--body "Automated manifest refresh from the release pipeline for v${VERSION}.

Version strings and sha256 checksums are rewritten from the published release
assets by \`scripts/submit-packages.mjs\`." \
|| echo "a PR for ${BRANCH} already exists; branch updated in place"
assets by \`scripts/submit-packages.mjs\`." 2>&1)"
RC=$?
set -e

echo "${OUT}"

if [ "${RC}" -ne 0 ]; then
if echo "${OUT}" | grep -qi "already exists"; then
echo "a PR for ${BRANCH} already exists; branch updated in place"
else
echo "gh pr create failed for ${BRANCH}" >&2
exit "${RC}"
fi
fi
Loading