Repository navigation
Grant pull-requests: read on Every validate-task Caller Stub - #4044
Conversation
A reusable workflow cannot raise its caller's grant, and a callee job naming a scope the caller withheld fails at startup. So the grant reaches the catalog snippets, the hub's own callers, and the documented stub shapes ahead of the lint job that will declare it. The lint job and the downstream stubs stay on #2354. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
Important Review skippedAuto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the
 |
|
A recorded local strict-review pass covers head |
There was a problem hiding this comment.
🟢 Approval recommended
No active review issues are present, and the permission updates consistently cover all documented and workflow callers.
No open issues 🎉
What changed in this PR
This PR prepares every current validate-task.yml caller for the lint job's future live pull-request label read by adding the required permission to catalog snippets, hub workflows, and documentation examples, while leaving the callee unchanged.
Changes:
- Add
pull-requests: readbesidecontents: readin all caller stubs. - Update reusable workflow documentation and examples.
- Document the staged permission rollout for the follow-up lint-job change.
| File | Description |
|---|---|
| docs/reusable-workflows.md | Documents the permission requirement and updates reusable workflow caller examples. |
| catalog/snippets/workflows/test-pull-request.yml | Grants pull-request read access to the catalog test caller. |
| catalog/snippets/workflows/test-pull-request-smoke.yml | Grants pull-request read access to the catalog smoke-test caller. |
| catalog/snippets/workflows/publish-release.yml | Grants pull-request read access to the catalog release validation caller. |
| .github/workflows/test-pull-request.yml | Grants pull-request read access to the hub test workflow caller. |
| .github/workflows/publish-release.yml | Grants pull-request read access to the hub release workflow caller. |
Review effort: Lite
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## develop #4044 +/- ##
========================================
Coverage 79.03% 79.03%
========================================
Files 37 37
Lines 12676 12676
========================================
Hits 10019 10019
Misses 2657 2657
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
…ry Short Names, Stub Read Grant (#4054) ## Summary Promotes burndown round 1 of the attended run of 2026-11-10 from `develop` to `main`. - #4047: an attested local pass keeps `coverage=local` against a round that only carries a file table. A promotion now reads green Dependabot manifest bumps as covered, through the new `pr_review_promotion.py`. The promotion case also counts an attestation over direct-to-`develop` changes and excuses byte-identical renames. - #4045: the loop skills resume a parked group on a recorded answer, present each question once, accept a clone tip at or behind head, and re-check `deferred` issues whose condition is checkable. An away run's endings that cannot dispatch a promotion worker now report that. - #4046: every registry entry carries a required, gated `shortName`. A changed short name fails the spec gate as a migration. - #4044: `pull-requests: read` on each caller stub's `validate` job, the hub half of #2354. It takes effect once the lint job declares the scope. - #4052, #4053, #4055, from other sessions: registry and rollout-tracker updates. They declare Python for Vantage-Config, register the Employment repository with its short name and pin, and reconcile the HolidayLights entry. Fixes #3955 Fixes #3909 Fixes #3901 Fixes #3905 Fixes #4012 Fixes #3830 Fixes #2669 Fixes #4023 Fixes #4028 #2354 stays open for the lint job's grant and the downstream rollout. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
Summary
Every caller of
validate-task.ymlnow grantspull-requests: readbesidecontents: read. That covers the three catalog snippets, the hub's owntest-pull-request.ymlandpublish-release.yml, and the stub shapes quoted indocs/reusable-workflows.md. A new paragraph under "Secrets and Permissions" says what the grant is for and that it does nothing until the lint job declares the scope.The lint job is deliberately unchanged. A callee job naming a scope its caller did not grant fails at startup, so the stubs have to carry the grant first.
#2354 stays open for the lint job's own grant and the stub-by-stub downstream rollout.
Closes on promotion: none
Verification
frontiertier raised no findings, and the pass is recorded and attested.repo_gate.py, actionlint, and markdownlint pass, and so doesspec/validate.py.test_audit_helpers,test_release_guards,test_repo_gate, andtest_spec_validatepass.Validate sources jobexercises the wider grant on the hub's callers.🤖 Generated with Claude Code