KofTwentyTwo/standards
2
0 Fork 0
Code Issues 3 Pull Requests 3 Actions Packages Projects Releases 6 Wiki Activity

fix(releases): carry PR read permission through release gates #13

Merged
KofTwentyTwo merged 2 commits from fix/release-gate-permissions into main 2026-10-10 14:24:30 +00:00
Conversation 1 Commits 2 Files Changed 4
+31 -5
KofTwentyTwo commented 2026-10-10 14:21:43 +00:00 (Migrated from github.com)
Copy link
Copy source

What

Grant the release gates the PR read permission their nested CI caller requires. Preserve optional PATCH checklist links. Closes #12.

Why

GitHub rejected the first tag before any job ran because reusable-workflow permissions cannot increase at a lower level, even for skipped PR jobs. Keep v0.1.0 unchanged; publish the first 0.1 bundle as v0.1.1.

Validation

Actionlint and zizmor pass. Dispatch the actual release workflow on this branch to check GitHub's complete call-chain validation without publishing (the top-level tag condition skips branch publication). Normal PR gates and reviewed version metadata remain required before tagging.

Commits are signed/DCO signed off. No new dependency or secret. Substantial AI assistance: Codex (GPT-6). Release-As: 0.1.1.

## What Grant the release gates the PR read permission their nested CI caller requires. Preserve optional PATCH checklist links. Closes #12. ## Why GitHub rejected the first tag before any job ran because reusable-workflow permissions cannot increase at a lower level, even for skipped PR jobs. Keep v0.1.0 unchanged; publish the first 0.1 bundle as v0.1.1. ## Validation Actionlint and zizmor pass. Dispatch the actual release workflow on this branch to check GitHub's complete call-chain validation without publishing (the top-level tag condition skips branch publication). Normal PR gates and reviewed version metadata remain required before tagging. Commits are signed/DCO signed off. No new dependency or secret. Substantial AI assistance: Codex (GPT-6). Release-As: 0.1.1.
KofTwentyTwo (Migrated from github.com) reviewed 2026-10-10 14:23:01 +00:00
KofTwentyTwo (Migrated from github.com) left a comment
Copy link
Copy source

Automated code review (Codex, GPT-6)

Reviewed nested GITHUB_TOKEN permissions, optional checklist validation, unchanged signed tag, and the pending-release proposal guard. The caller adds only PR read access required by the reusable CI job. GitHub's real workflow_dispatch on this branch compiled successfully and skipped tag-only publication; the original v0.1.0 run failed compilation before any job. This directly verifies the startup fix.

The App already opened a premature 0.2.0 proposal after 0.1.0 metadata merged but before publication. An explicit REST guard now prevents another version while a merged PR has autorelease: pending. The guard uses immediate PR state rather than search indexing, and publication clears that label only after immutable=true. Failed 0.1.0 is labeled autorelease: failed, preserving its tag.

Actionlint/zizmor pass. No new secrets/dependencies or bypass. Current-head required CI must pass before merge. Squash commit must preserve Release-As: 0.1.1 so the existing bot proposal updates to the intended first published patch. No remaining review blockers.

## Automated code review (Codex, GPT-6) Reviewed nested GITHUB_TOKEN permissions, optional checklist validation, unchanged signed tag, and the pending-release proposal guard. The caller adds only PR read access required by the reusable CI job. GitHub's real workflow_dispatch on this branch compiled successfully and skipped tag-only publication; the original v0.1.0 run failed compilation before any job. This directly verifies the startup fix. The App already opened a premature 0.2.0 proposal after 0.1.0 metadata merged but before publication. An explicit REST guard now prevents another version while a merged PR has autorelease: pending. The guard uses immediate PR state rather than search indexing, and publication clears that label only after immutable=true. Failed 0.1.0 is labeled autorelease: failed, preserving its tag. Actionlint/zizmor pass. No new secrets/dependencies or bypass. Current-head required CI must pass before merge. Squash commit must preserve Release-As: 0.1.1 so the existing bot proposal updates to the intended first published patch. No remaining review blockers.
Sign in to join this conversation.
Reviewers
No Reviewers
KofTwentyTwo
Labels
Clear labels
accessibility
Barrier affecting people with disabilities
 autorelease: failed
Reserved version tag; no published release
 autorelease: pending
autorelease: tagged
breaking
Incompatible new mandatory standards; requires a MAJOR release
 bug
Something isn't working
 dependencies
Pull requests that update a dependency file
 documentation
Improvements or additions to documentation
 duplicate
This issue or pull request already exists
 enhancement
New feature or request
 github_actions
Pull requests that update GitHub Actions code
 good first issue
Good for newcomers
 help wanted
Extra attention is needed
 invalid
This doesn't seem right
 question
Further information is requested
 release: failed
Reserved release tag failed before public publication; preserved for audit.
 release: ready
Maintainer-approved release preflight
 wontfix
This will not be worked on
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
forge-recovery (Forge Recovery) james.maes (James Maes)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: KofTwentyTwo/standards#13