From 1cd620cc405459aeb1cf99414850786483218b07 Mon Sep 17 00:00:00 2001 From: Eric Bailey Date: Wed, 17 Jun 2026 17:59:34 -0500 Subject: [PATCH] Grant contents: write to the android nightly caller job GitHub statically validates the reusable-workflow permission ceiling, so calling build-submit-android.yml fails validation because its attachToRelease job requests contents: write while the nightly caller only granted read. That job is skipped for nightly builds (it needs a production tag), but the check runs at parse time regardless. Scope the write permission to the android caller job so the rest of the workflow stays read-only. Co-Authored-By: Claude Opus 4.8 --- .github/workflows/nightly-build.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.github/workflows/nightly-build.yml b/.github/workflows/nightly-build.yml index 9fe0ce8bfc..48e4ea4ca1 100644 --- a/.github/workflows/nightly-build.yml +++ b/.github/workflows/nightly-build.yml @@ -84,6 +84,11 @@ jobs: android: name: Nightly Android Build needs: [prepare] + # build-submit-android.yml contains an attachToRelease job that requests contents: write. + # That job is skipped for nightly (it needs a production tag build), but GitHub statically + # validates the reusable-workflow permission ceiling, so the caller must grant it here. + permissions: + contents: write uses: ./.github/workflows/build-submit-android.yml with: profile: testflight-android