From 9ebb8475c5a6e9811314802e00c2f9c7b2920b3e Mon Sep 17 00:00:00 2001 From: Teddy Harnatkiewicz Date: Fri, 4 Sep 2026 13:10:37 -0400 Subject: [PATCH] fix(ci): grant the tag workflow's release job the permissions release.yml declares A workflow called via workflow_call cannot exceed its caller job's permissions grant. tag.yaml's release job granted only contents: write, while release.yml declares id-token: write and attestations: write for provenance attestation, so every workflow_dispatch of 'Tag a Release' failed at startup with no jobs or logs. The manual tag-push path was unaffected because it triggers release.yml directly with its own permissions, which is why v0.3.0 released fine by hand. Co-Authored-By: Claude Fable 5 --- .github/workflows/tag.yaml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.github/workflows/tag.yaml b/.github/workflows/tag.yaml index 5469c16..27cc315 100644 --- a/.github/workflows/tag.yaml +++ b/.github/workflows/tag.yaml @@ -52,5 +52,10 @@ jobs: with: tag_name: ${{ needs.tag.outputs.new-tag-version }} if: needs.tag.outputs.new-tag == 'true' && needs.tag.outputs.new-tag-version-type != 'major' + # Must cover every permission release.yml declares: a called workflow + # cannot exceed its caller's grant, and the mismatch fails the dispatch + # at startup with no jobs or logs. permissions: contents: write # allow create release + id-token: write # attest provenance + attestations: write # attest provenance