fix: grant actions:read permission to CI e2e test jobs

[julio-rocketchat]

Summary

• chore: apply least privilege permissions to github actions #40687 applied least-privilege GitHub Actions permissions, scoping ci.yml's GITHUB_TOKEN to contents: read at the workflow level.
• ci-test-e2e.yml (called by ci.yml via uses:) requires actions: read at the job level (needed by actions/download-artifact), which exceeds the caller's granted permissions.
• A reusable workflow cannot be granted more permissions than its caller allows, so GitHub rejects the entire run at startup — this broke CI on every push/PR since the merge (e.g. https://github.com/RocketChat/Rocket.Chat/actions/runs/28599899385, startup_failure, 0 jobs scheduled).

Fix

Add actions: read (alongside contents: read) at the job level in ci.yml for the six jobs that call ci-test-e2e.yml (test-api, test-api-livechat, test-ui, test-api-ee, test-api-livechat-ee, test-ui-ee), scoped only to those jobs rather than widening the workflow-level default.

Test plan

• Confirm the CI workflow schedules jobs (no startup_failure) on this PR
• Confirm test-api, test-api-livechat, test-ui, test-api-ee, test-api-livechat-ee, test-ui-ee run and pass

Summary by CodeRabbit

• Chores
  • Updated automated test workflow permissions to be more restrictive for several end-to-end test jobs.
  • No user-facing functionality changed.

[dionisio-bot]

Looks like this PR is not ready to merge, because of the following issues:

• This PR is missing the 'stat: QA assured' label
• This PR is missing the required milestone or project

Please fix the issues and try again

If you have any trouble, please check the PR guidelines

[changeset-bot]

⚠️ No Changeset found

Latest commit: 1e85c1a

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 75d6897d-e5c5-4698-a280-ec08def90453

📥 Commits

Reviewing files that changed from the base of the PR and between 5e5990a and 1e85c1a.

📒 Files selected for processing (1)

• .github/workflows/ci.yml

📜 Recent review details

⏰ Context from checks skipped due to timeout. (8)

• GitHub Check: 🔎 Code Check / TypeScript
• GitHub Check: 🔎 Code Check / Code Lint
• GitHub Check: 🔨 Test Unit / Unit Tests
• GitHub Check: 🔨 Test Storybook / Test Storybook
• GitHub Check: 📦 Meteor Build (coverage)
• GitHub Check: cubic · AI code reviewer
• GitHub Check: Hacktron Security Check
• GitHub Check: CodeQL-Build

🧰 Additional context used

🧠 Learnings (1)

📚 Learning: 2026-04-27T18:32:21.871Z

Learnt from: d-gubert
Repo: RocketChat/Rocket.Chat PR: 40321
File: .github/workflows/ci.yml:137-145
Timestamp: 2026-04-27T18:32:21.871Z
Learning: In .github/workflows/ci.yml, the `diff` step under `release-versions` intentionally uses a bash `if` with `gh pr diff ... | grep -q ...; then ... fi`. For non-`pull_request` workflow triggers where `GH_PR_NUM` can be empty, the `gh` command may fail, but the surrounding bash `if` is relied on to treat that failure as the condition being false and skip the `then` block, allowing the step/job to exit cleanly. Do not add extra guards for non-PR event types unless this failure/skip behavior is intentionally changed.

Applied to files:

• .github/workflows/ci.yml

🔇 Additional comments (1)

.github/workflows/ci.yml (1)

560-562: LGTM!

Also applies to: 580-582, 600-602, 629-631, 653-655, 677-679

---

Walkthrough

This PR adds job-level permissions blocks restricting actions: read and contents: read to six e2e test jobs in the CI workflow, applied before each job invokes the shared reusable e2e workflow.

Changes

CI e2e job permissions

Layer / File(s)	Summary
Add explicit permissions to e2e test jobs .github/workflows/ci.yml	Six jobs (test-api, test-api-livechat, test-ui, test-api-ee, test-api-livechat-ee, test-ui-ee) each receive a job-level permissions block limited to actions: read and contents: read before invoking the reusable e2e workflow.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Suggested labels: type: bug

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: adding actions:read to the CI E2E test jobs.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 69.13%. Comparing base (cbbcd47) to head (1e85c1a).
⚠️ Report is 4 commits behind head on develop.

Additional details and impacted files

@@             Coverage Diff             @@
##           develop   #41147      +/-   ##
===========================================
- Coverage    69.14%   69.13%   -0.02%     
===========================================
  Files         3433     3433              
  Lines       132444   132444              
  Branches     23081    23106      +25     
===========================================
- Hits         91579    91560      -19     
- Misses       37502    37511       +9     
- Partials      3363     3373      +10     

Flag	Coverage Δ
e2e	59.34% <ø> (-0.07%)	⬇️
e2e-api	41.13% <ø> (+0.65%)	⬆️
unit	69.96% <ø> (-0.03%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[cubic-dev-ai]

No issues found across 1 file

_{Re-trigger cubic}