codex-bot-andresmgsl/ceremony
1
0
Fork 0
forked from heavy-duty/ceremony
Code Pull requests Activity

Merge pull request #174 from codex-bot-andresmgsl/build/173-private-read-scopes

Browse source 
docs: add actions read to private caller guidance
This commit is contained in:
Daniel Marin 2026-07-25 00:35:46 +01:00 committed by GitHub
commit 486bbd10a4
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
4 changed files with 6 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
actions/labels-reconcile/labels-reconcile.sh
View file

@ -70,9 +70,9 @@ blind_sweep_warning() { # $1 = unreadable PRs, $2 = all open PRs, $3 = sampled r
if [ "$2" -gt 0 ] && [ "$1" -eq "$2" ]; then
local reason="${3:-}"
if [ -n "$reason" ]; then
echo "::warning::labels: every open PR was unreadable; sampled reason: $reason — one candidate is missing checks: read and statuses: read in the caller (private repos do not imply them)"
echo "::warning::labels: every open PR was unreadable; sampled reason: $reason — one candidate is missing checks: read, statuses: read and actions: read in the caller (private repos do not imply them)"
else
echo "::warning::labels: every open PR was unreadable; no reason was captured — one candidate is missing checks: read and statuses: read in the caller (private repos do not imply them)"
echo "::warning::labels: every open PR was unreadable; no reason was captured — one candidate is missing checks: read, statuses: read and actions: read in the caller (private repos do not imply them)"
fi
fi
}

1
changelog.d/173.md Normal file
View file

@ -0,0 +1 @@
- Private-repository label callers document `actions: read` alongside checks and statuses for workflow-run check-rollup nodes (#173).

3
docs/CONSUMERS.md
View file

@ -314,6 +314,7 @@ permissions:
contents: read
checks: read # mergeability/check-rollup read for PR state
statuses: read # commit-status rollup read for PR state
actions: read # workflow-run nodes inside the check rollup — private repos do not imply it (incubator#60)
issues: write
pull-requests: write
jobs:
@ -323,7 +324,7 @@ jobs:
Naming any permission sets every unnamed permission to `none`. Public
repositories allow check data to be read regardless, but a private consumer
needs both explicit reads above; without them the failure appears as an empty
needs all three explicit reads above; without them the failure appears as an empty
`state:*` axis on the board rather than a red workflow run.
The `issues:` trigger is available at `0.2.0` and later — `0.2.0` is the

2
test/labels-reconcile.test.sh
View file

@ -41,7 +41,7 @@ reviews() { jq -s '.' <<<"$*"; } # collect review objects into an array
# -- a sweep-wide read failure is visible without changing any PR ------------
warning="$(blind_sweep_warning 3 3 "HTTP 403: Resource not accessible by integration")"
expect "a wholly blind sweep warns, leading with the observed reason" \
"::warning::labels: every open PR was unreadable; sampled reason: HTTP 403: Resource not accessible by integration — one candidate is missing checks: read and statuses: read in the caller (private repos do not imply them)" \
"::warning::labels: every open PR was unreadable; sampled reason: HTTP 403: Resource not accessible by integration — one candidate is missing checks: read, statuses: read and actions: read in the caller (private repos do not imply them)" \
"$warning"
expect "the blind warning names checks: read" named \
"$(grep -qF "checks: read" <<<"$warning" && echo named || echo missing)"