From b810d4968b798980f325b0861b58c2719ea4171a Mon Sep 17 00:00:00 2001 From: Lucas Santana Date: Sun, 14 Jun 2026 20:45:54 -0300 Subject: [PATCH] fix(ci): grant review-tools caller the scopes its reusables require MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit review-tools.yml set an explicit permissions block (contents:read, pull-requests:write), which forces every unlisted scope to none. The called reusables request more — claude-review.yml needs issues:write + id-token:write, danger.yml needs issues:write — and a called workflow cannot request scopes the caller withheld, so GitHub failed the run at startup on 100% of PRs (Claude review + Danger never ran). Granted the union of required scopes. Closes #1423 --- .github/workflows/review-tools.yml | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/.github/workflows/review-tools.yml b/.github/workflows/review-tools.yml index c92a5cf51..0e23caed7 100644 --- a/.github/workflows/review-tools.yml +++ b/.github/workflows/review-tools.yml @@ -31,12 +31,18 @@ concurrency: group: review-tools-${{ github.event.pull_request.number }} cancel-in-progress: true -# Minimum permissions for both reusable workflows: -# - claude-review.yml needs to read PR contents and post review comments -# - danger.yml needs to read PR diff and post a comment with findings +# Minimum permissions for both reusable workflows. An explicit block sets +# every unlisted scope to `none`, and a called reusable workflow cannot +# request scopes the caller withheld — so the caller must grant the UNION of +# what the reusables declare, or the run fails at startup (see #1423): +# - claude-review.yml needs contents:read, pull-requests:write, +# issues:write, and id-token:write (OIDC) +# - danger.yml needs contents:read, pull-requests:write, issues:write permissions: contents: read pull-requests: write + issues: write + id-token: write jobs: claude-review: