From 1e85c1aa3390552f2f8585f4e59c64b5506f0def Mon Sep 17 00:00:00 2001
From: Julio Araujo <julio.araujo@rocket.chat>
Date: Thu, 2 Jul 2026 18:49:03 +0200
Subject: [PATCH] fix: grant actions:read permission to CI e2e test jobs

The least-privilege permissions change (#40687) restricted ci.yml's
GITHUB_TOKEN to contents:read, but the reusable ci-test-e2e.yml
workflow it calls requires actions:read (needed by
actions/download-artifact). Since a reusable workflow can't be
granted more permissions than its caller has, this permission
mismatch caused the entire CI workflow to fail at startup
(startup_failure, 0 jobs scheduled) on every push/PR.
---
 .github/workflows/ci.yml | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index bb6a9ce542983..a215eae20e483 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -557,6 +557,9 @@ jobs:
   test-api:
     name: 🔨 Test API (CE)
     needs: [checks, build-gh-docker-publish, release-versions]
+    permissions:
+      actions: read
+      contents: read
 
     uses: ./.github/workflows/ci-test-e2e.yml
     with:
@@ -574,6 +577,9 @@ jobs:
   test-api-livechat:
     name: 🔨 Test API Livechat (CE)
     needs: [checks, build-gh-docker-publish, release-versions]
+    permissions:
+      actions: read
+      contents: read
 
     uses: ./.github/workflows/ci-test-e2e.yml
     with:
@@ -591,6 +597,9 @@ jobs:
   test-ui:
     name: 🔨 Test UI (CE)
     needs: [checks, build-gh-docker-publish, release-versions]
+    permissions:
+      actions: read
+      contents: read
 
     uses: ./.github/workflows/ci-test-e2e.yml
     with:
@@ -617,6 +626,9 @@ jobs:
   test-api-ee:
     name: 🔨 Test API (EE)
     needs: [checks, build-gh-docker-publish, release-versions]
+    permissions:
+      actions: read
+      contents: read
 
     uses: ./.github/workflows/ci-test-e2e.yml
     with:
@@ -638,6 +650,9 @@ jobs:
   test-api-livechat-ee:
     name: 🔨 Test API Livechat (EE)
     needs: [checks, build-gh-docker-publish, release-versions]
+    permissions:
+      actions: read
+      contents: read
 
     uses: ./.github/workflows/ci-test-e2e.yml
     with:
@@ -659,6 +674,9 @@ jobs:
   test-ui-ee:
     name: 🔨 Test UI (EE)
     needs: [checks, build-gh-docker-publish, release-versions]
+    permissions:
+      actions: read
+      contents: read
 
     uses: ./.github/workflows/ci-test-e2e.yml
     with: