acetheking987/bsky-social-app
1
0
Fork 0
Code Issues Actions Packages Projects Releases 1 Wiki Activity

Grant contents: write to the android nightly caller job

Browse Source 
GitHub statically validates the reusable-workflow permission ceiling, so
calling build-submit-android.yml fails validation because its attachToRelease
job requests contents: write while the nightly caller only granted read. That
job is skipped for nightly builds (it needs a production tag), but the check
runs at parse time regardless. Scope the write permission to the android
caller job so the rest of the workflow stays read-only.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Eric Bailey
2026-06-17 17:59:34 -05:00
parent 1a8ca710ee
commit 1cd620cc40
1 changed files with 5 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/nightly-build.yml
+5
View File
@@ -84,6 +84,11 @@ jobs:
android: android:
name: Nightly Android Build name: Nightly Android Build
needs: [prepare] needs: [prepare]
# build-submit-android.yml contains an attachToRelease job that requests contents: write.
# That job is skipped for nightly (it needs a production tag build), but GitHub statically
# validates the reusable-workflow permission ceiling, so the caller must grant it here.
permissions:
contents: write
uses: ./.github/workflows/build-submit-android.yml uses: ./.github/workflows/build-submit-android.yml
with: with:
profile: testflight-android profile: testflight-android