fix(ci): add checks: write permissions to resolve blocked fork PRs - #26018
Closed
am423 wants to merge 1 commit into
Closed
fix(ci): add checks: write permissions to resolve blocked fork PRs#26018am423 wants to merge 1 commit into
am423 wants to merge 1 commit into
Conversation
…flows This fixes 'no checks / BLOCKED' state on PRs opened from forks. GitHub requires explicit 'checks: write' permission for workflows to report status checks when triggered from fork PRs. Previously most workflows only had 'contents: read', which left them unable to post check results → PR appeared blocked with no CI output. Affected workflows (all PR-relevant ones): - tests.yml - lint.yml - contributor-check.yml - supply-chain-audit.yml - nix.yml - uv-lockfile-check.yml - docs-site-checks.yml - nix-lockfile-fix.yml This should resolve the blocked CI comment on PR NousResearch#25968.
Contributor
Author
|
Recommended labels for this PR:
These should help maintainers quickly triage it. This is a small CI permissions fix to unblock fork PRs (including the first-class xAI OAuth work in #25968). @maintainers — could you please add the above labels? Thanks! |
alt-glitch
added
type/refactor
Contributor
|
Thank you for investigating the blocked-checks problem. This is an automated hermes-sweeper review; current
The PR is currently conflicting against this newer workflow layout, so its permission-only patch is superseded by the implementation on |
teknium1
added
the
sweeper:implemented-on-main
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR adds explicit
checks: write(andpull-requests: writewhere appropriate) permissions to all PR-relevant GitHub Actions workflows.Problem
PRs opened from forks currently show no CI checks and appear as
BLOCKED. This was noted on #25968:Root Cause
GitHub runs workflows from fork PRs with a restricted
GITHUB_TOKEN. Withoutchecks: write, jobs cannot report status checks.Fix
Updated the following workflows:
tests.ymllint.ymlcontributor-check.ymlsupply-chain-audit.ymlnix.ymluv-lockfile-check.ymldocs-site-checks.ymlnix-lockfile-fix.ymlThis is a small infrastructure change that should allow CI to run and report properly on external contributions going forward, including the first-class xAI (Grok) OAuth provider work in #25968.