ci: grant publish job contents:write for lockfile auto-commit#86
Merged
Conversation
The publish job's 'Commit lockfile (if changed)' step failed with HTTP 403 on git push because the workflow-level permissions block grants only contents:read. Override at the job level so only publish gets write access; other jobs (lint, unit, pipeline, smoke-action) keep the read-only default. Symptom seen post-merge of #85: redis 6.3.0 bundles successfully pushed to GHCR, but the bundles.lock commit could not land on main, leaving the in-tree lockfile out of sync with the GHCR registry.
This was referenced Apr 27, 2026
phramz
added a commit
that referenced
this pull request
Apr 27, 2026
…89) Manually-regenerated bundles.lock from `phpup lockfile-update` against ghcr.io/buildrush. Replaces the 8 existing `ext:redis:6.2.0:{8.1..8.4}:*` entries with the corresponding 6.3.0 entries, and adds 2 new `ext:redis:6.3.0:8.5:*` entries (8.5 was previously excluded for redis pre-#76). Brings main back to a fully consistent state — catalog, lockfile, and GHCR all agree on redis 6.3.0 — completing the work started in #76. The non-redis line-level churn in this diff is in-entry digest/spec_hash refresh from the multiple publish runs that fired during the chain of fixes (#85, #86, #87, #88). Bundle keys themselves are unchanged outside of redis. Per internal/testsuite/runner.go:345-346, manifest digests are non-reproducible across pushes because meta.json carries a build-time timestamp; this is expected behavior, not a regression. Why this is committed by hand rather than auto-committed by the publish job: the publish job's git push is rejected by the main-branch ruleset ("Changes must be made through a pull request"). A follow-up will either switch the auto-commit to a bot-PR flow or grant the publish identity a ruleset bypass; until then, version-bump PRs require this manual lockfile-update PR step.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a job-level `permissions:` block to `publish` granting `contents: write`, while leaving the workflow-level `contents: read` default for every other job. Minimum-privilege: only the `publish` job needs write access (to push the `bundles.lock` auto-update commit back to main).
Why
Post-merge run for #85 (`24988341535`) revealed:
```
fatal: unable to access 'https://github.com/buildrush/setup-php/': The requested URL returned error: 403
```
Root cause: the workflow-level `permissions:` block (lines 14–17) grants only `contents: read`. The `publish` job inherits that and the `GITHUB_TOKEN` it uses for the `actions/checkout` (`token: ${{ secrets.GITHUB_TOKEN }}`) cannot push.
After this change, `publish` runs end-to-end on the next push to main, the `chore(lock): update bundles.lock from pipeline ` commit lands, and the in-tree lockfile rejoins the GHCR registry state.
State of main right now
Once this PR merges and the next `publish` job runs on main, the lockfile catches up and the regression resolves.
Test plan
Related: #38 (redis bump, PR #76), #83 (smoke-action self-containment, PR #85).