GitHub statically validates the reusable-workflow permission ceiling, so
calling build-submit-android.yml fails validation because its attachToRelease
job requests contents: write while the nightly caller only granted read. That
job is skipped for nightly builds (it needs a production tag), but the check
runs at parse time regardless. Scope the write permission to the android
caller job so the rest of the workflow stays read-only.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Eric Bailey
1cd620cc40