heavy-duty/ceremony
7
0
Fork 2
Code Issues 1 Pull requests Projects Releases 8 Packages Wiki Activity Actions

docs: add actions read to private caller guidance

Browse source
This commit is contained in:
codex-bot-andresmgsl 2026-07-24 22:57:22 +00:00
parent 68354f846a
commit eae000bd62
4 changed files with 6 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
actions/labels-reconcile/labels-reconcile.sh
View file

@ -70,9 +70,9 @@ blind_sweep_warning() { # $1 = unreadable PRs, $2 = all open PRs, $3 = sampled r
if [ "$2" -gt 0 ] && [ "$1" -eq "$2" ]; then if [ "$2" -gt 0 ] && [ "$1" -eq "$2" ]; then
local reason="${3:-}" local reason="${3:-}"
if [ -n "$reason" ]; then if [ -n "$reason" ]; then
echo "::warning::labels: every open PR was unreadable; sampled reason: $reason — one candidate is missing checks: read and statuses: read in the caller (private repos do not imply them)" echo "::warning::labels: every open PR was unreadable; sampled reason: $reason — one candidate is missing checks: read, statuses: read and actions: read in the caller (private repos do not imply them)"
else else
echo "::warning::labels: every open PR was unreadable; no reason was captured — one candidate is missing checks: read and statuses: read in the caller (private repos do not imply them)" echo "::warning::labels: every open PR was unreadable; no reason was captured — one candidate is missing checks: read, statuses: read and actions: read in the caller (private repos do not imply them)"
fi fi
fi fi
} }

1
changelog.d/173.md Normal file
View file

@ -0,0 +1 @@
- Private-repository label callers document `actions: read` alongside checks and statuses for workflow-run check-rollup nodes (#173).

3
docs/CONSUMERS.md
View file

@ -314,6 +314,7 @@ permissions:
contents: read contents: read
checks: read # mergeability/check-rollup read for PR state checks: read # mergeability/check-rollup read for PR state
statuses: read # commit-status rollup read for PR state statuses: read # commit-status rollup read for PR state
actions: read # workflow-run nodes inside the check rollup — private repos do not imply it (incubator#60)
issues: write issues: write
pull-requests: write pull-requests: write
jobs: jobs:
@ -323,7 +324,7 @@ jobs:
Naming any permission sets every unnamed permission to `none`. Public Naming any permission sets every unnamed permission to `none`. Public
repositories allow check data to be read regardless, but a private consumer repositories allow check data to be read regardless, but a private consumer
needs both explicit reads above; without them the failure appears as an empty needs all three explicit reads above; without them the failure appears as an empty
`state:*` axis on the board rather than a red workflow run. `state:*` axis on the board rather than a red workflow run.
The `issues:` trigger is available at `0.2.0` and later — `0.2.0` is the The `issues:` trigger is available at `0.2.0` and later — `0.2.0` is the

2
test/labels-reconcile.test.sh
View file

@ -41,7 +41,7 @@ reviews() { jq -s '.' <<<"$*"; } # collect review objects into an array
# -- a sweep-wide read failure is visible without changing any PR ------------ # -- a sweep-wide read failure is visible without changing any PR ------------
warning="$(blind_sweep_warning 3 3 "HTTP 403: Resource not accessible by integration")" warning="$(blind_sweep_warning 3 3 "HTTP 403: Resource not accessible by integration")"
expect "a wholly blind sweep warns, leading with the observed reason" \ expect "a wholly blind sweep warns, leading with the observed reason" \
"::warning::labels: every open PR was unreadable; sampled reason: HTTP 403: Resource not accessible by integration — one candidate is missing checks: read and statuses: read in the caller (private repos do not imply them)" \ "::warning::labels: every open PR was unreadable; sampled reason: HTTP 403: Resource not accessible by integration — one candidate is missing checks: read, statuses: read and actions: read in the caller (private repos do not imply them)" \
"$warning" "$warning"
expect "the blind warning names checks: read" named \ expect "the blind warning names checks: read" named \
"$(grep -qF "checks: read" <<<"$warning" && echo named || echo missing)" "$(grep -qF "checks: read" <<<"$warning" && echo named || echo missing)"