Repository navigation
fix(ci): add actions:read permission to multi-arch workflows - #10573
Merged
Merged
Conversation
All workflows that call setup_multi_arch.yml need actions:read permission for the stage reuse feature to query GitHub API for baseline workflow runs. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
geomin12
added
skip-therockci
github-actions
Bot
added
github actions
project: none
✅ All Checks Passed — Ready for Review
📖 Need help? See the Policy FAQ for details on every check and how to fix failures. |
|
🎉 All checks passed! This PR is ready for review. |
geomin12
added a commit
to ROCm/TheRock
that referenced
this pull request
Aug 10, 2026
) (#7234) Re-landing #7193 after revert <b>Previous error and fix</b>: Previous error: https://github.com/ROCm/TheRock/actions/runs/31252419491/workflow All workflows that call `setup_multi_arch.yml` need `actions: read` permission for the stage reuse feature. The stage reuse feature queries the GitHub API to find baseline workflow runs for artifact reuse, which requires this permission. ### Changes #### rocm-libraries (`users/geomin12/permission-fix`) PR: ROCm/rocm-libraries#10573 | Workflow | Change | |----------|--------| | `therock-multi-arch-ci-asan-nightly.yml` | Added `actions: read` | | `therock-multi-arch-ci-asan.yml` | Added `actions: read` | | `therock-multi-arch-ci-nightly.yml` | Added `actions: read` | | `therock-multi-arch-ci.yml` | Already has `actions: read` | #### rocm-systems (`users/geomin12/permission-fix`) PR: ROCm/rocm-systems#9910 | Workflow | Change | |----------|--------| | `therock-multi-arch-ci-asan-nightly.yml` | Added `actions: read` | | `therock-multi-arch-ci-asan.yml` | Added `actions: read` | | `therock-multi-arch-ci-nightly.yml` | Already has `actions: write` | | `therock-multi-arch-ci.yml` | Already has `actions: read` | #### rockrel No changes needed - all multi-arch workflows have job-level `actions: write` permissions which is a superset of `actions: read`. <b>Description</b>: Enable external repos (rocm-libraries, rocm-systems) to dynamically determine which TheRock stages need rebuilding based on their changes. Changes: - setup_multi_arch.yml: Add EXTERNAL_REPO env var and GITHUB_TOKEN for baseline run API calls. Use THEROCK_REPOSITORY for baseline selection. - configure_multi_arch_ci.py: Add GitContext.from_external_repo() to create context with repo name as changed file. Skip path filtering for external repos and apply stage reuse from TheRock baselines. - stage_reuse_decision.py: Use THEROCK_REPOSITORY for baseline run selection so external repos can query TheRock baselines. - configure_external_repo_ci.py: Update docstring and exclude workflow files from full test triggers. How it works: 1. External repo passes EXTERNAL_REPO JSON with repository name 2. configure_multi_arch_ci.py extracts repo name (e.g., "rocm-libraries") 3. Stage impact analysis maps repo name to affected stages (e.g., math-libs) 4. Unaffected stages are candidates for reuse from TheRock baselines 5. Commit-compatible baseline runs provide prebuilt artifacts Working here: https://github.com/ROCm/rocm-libraries/actions/runs/31032656859/job/92397575440?pr=10339#step:4:198 (however, no baseline as this is on a feature branch) ``` Writing job summary: ### Stage reuse analysis - mode: `reuse-stage` - full rebuild required: `False` - baseline run checked: _none_ - unaffected candidates: `comm-libs`, `compiler-runtime`, `dctools-core`, `debug-tools`, `media-libs`, `profiler-apps`, `runtime-tests`, `storage-libs`, `wsl-rocdxg` - available in baseline: _none_ - applied: _none_ - available per platform: - linux: _none_ - windows: _none_ ``` ISSUE ID: #3343 --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
All workflows that call setup_multi_arch.yml need actions:read permission for the stage reuse feature to query GitHub API for baseline workflow runs.
ISSUE ID: ROCm/TheRock#3343