From fa15d86ffeb452fe44a42130c86f4af2abf52ad9 Mon Sep 17 00:00:00 2001 From: Jack Amadeo Date: Fri, 1 Aug 2025 09:46:43 -0400 Subject: [PATCH 1/3] See if this fixes it --- .github/workflows/canary.yml | 6 ++++++ .github/workflows/ci.yml | 2 ++ .github/workflows/pr-comment-bundle-intel.yml | 2 ++ .github/workflows/pr-comment-bundle-windows.yml | 2 ++ .github/workflows/pr-comment-bundle.yml | 2 ++ .github/workflows/release.yml | 8 ++++++++ 6 files changed, 22 insertions(+) diff --git a/.github/workflows/canary.yml b/.github/workflows/canary.yml index 55cf394983b2..d296d3db50a1 100644 --- a/.github/workflows/canary.yml +++ b/.github/workflows/canary.yml @@ -65,6 +65,8 @@ jobs: bundle-desktop: needs: [prepare-version] uses: ./.github/workflows/bundle-desktop.yml + permissions: + id-token: write with: version: ${{ needs.prepare-version.outputs.version }} signing: false @@ -75,6 +77,8 @@ jobs: bundle-desktop-linux: needs: [prepare-version] uses: ./.github/workflows/bundle-desktop-linux.yml + permissions: + id-token: write with: version: ${{ needs.prepare-version.outputs.version }} @@ -84,6 +88,8 @@ jobs: bundle-desktop-windows: needs: [prepare-version] uses: ./.github/workflows/bundle-desktop-windows.yml + permissions: + id-token: write with: version: ${{ needs.prepare-version.outputs.version }} signing: false diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 5152d3049535..dc30ec4925cb 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -120,6 +120,8 @@ jobs: # Faster Desktop App build for PRs only bundle-desktop-unsigned: uses: ./.github/workflows/bundle-desktop.yml + permissions: + id-token: write needs: changes if: (github.event_name == 'pull_request' || github.event_name == 'merge_group') && (needs.changes.outputs.code == 'true' || github.event_name != 'pull_request') with: diff --git a/.github/workflows/pr-comment-bundle-intel.yml b/.github/workflows/pr-comment-bundle-intel.yml index e0f63c699879..97873aa57db9 100644 --- a/.github/workflows/pr-comment-bundle-intel.yml +++ b/.github/workflows/pr-comment-bundle-intel.yml @@ -63,6 +63,8 @@ jobs: needs: [trigger-on-command] if: ${{ needs.trigger-on-command.outputs.continue == 'true' }} uses: ./.github/workflows/bundle-desktop-intel.yml + permissions: + id-token: write with: signing: false ref: ${{ needs.trigger-on-command.outputs.head_sha }} diff --git a/.github/workflows/pr-comment-bundle-windows.yml b/.github/workflows/pr-comment-bundle-windows.yml index e966d2af07d9..17ebf78a2d64 100644 --- a/.github/workflows/pr-comment-bundle-windows.yml +++ b/.github/workflows/pr-comment-bundle-windows.yml @@ -66,6 +66,8 @@ jobs: needs: [trigger-on-command] if: ${{ needs.trigger-on-command.outputs.continue == 'true' }} uses: ./.github/workflows/bundle-desktop-windows.yml + permissions: + id-token: write with: signing: false ref: ${{ needs.trigger-on-command.outputs.head_sha }} diff --git a/.github/workflows/pr-comment-bundle.yml b/.github/workflows/pr-comment-bundle.yml index 0561682a2b38..3e1be17ef7fb 100644 --- a/.github/workflows/pr-comment-bundle.yml +++ b/.github/workflows/pr-comment-bundle.yml @@ -107,6 +107,8 @@ jobs: needs: [trigger-on-command] if: ${{ needs.trigger-on-command.outputs.continue == 'true' }} uses: ./.github/workflows/bundle-desktop.yml + permissions: + id-token: write with: signing: false ref: ${{ needs.trigger-on-command.outputs.pr_sha }} diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 644518a5c1ce..77afe20306fe 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -44,6 +44,8 @@ jobs: # ------------------------------------------------------------ bundle-desktop: uses: ./.github/workflows/bundle-desktop.yml + permissions: + id-token: write with: signing: true secrets: @@ -54,6 +56,8 @@ jobs: # ------------------------------------------------------------ bundle-desktop-intel: uses: ./.github/workflows/bundle-desktop-intel.yml + permissions: + id-token: write with: signing: true secrets: @@ -64,12 +68,16 @@ jobs: # ------------------------------------------------------------ bundle-desktop-linux: uses: ./.github/workflows/bundle-desktop-linux.yml + permissions: + id-token: write # # ------------------------------------------------------------ # # 6) Bundle Desktop App (Windows) # # ------------------------------------------------------------ bundle-desktop-windows: uses: ./.github/workflows/bundle-desktop-windows.yml + permissions: + id-token: write with: signing: true secrets: From ee59cb590a1d9e98c9c3d11f7d4e73780fd40517 Mon Sep 17 00:00:00 2001 From: Jack Amadeo Date: Fri, 1 Aug 2025 09:55:42 -0400 Subject: [PATCH 2/3] Also contents: read --- .github/workflows/canary.yml | 3 +++ .github/workflows/ci.yml | 1 + .github/workflows/pr-comment-bundle-intel.yml | 1 + .github/workflows/pr-comment-bundle-windows.yml | 1 + .github/workflows/pr-comment-bundle.yml | 1 + .github/workflows/release.yml | 4 ++++ 6 files changed, 11 insertions(+) diff --git a/.github/workflows/canary.yml b/.github/workflows/canary.yml index d296d3db50a1..0dbf33e70d75 100644 --- a/.github/workflows/canary.yml +++ b/.github/workflows/canary.yml @@ -67,6 +67,7 @@ jobs: uses: ./.github/workflows/bundle-desktop.yml permissions: id-token: write + contents: read with: version: ${{ needs.prepare-version.outputs.version }} signing: false @@ -79,6 +80,7 @@ jobs: uses: ./.github/workflows/bundle-desktop-linux.yml permissions: id-token: write + contents: read with: version: ${{ needs.prepare-version.outputs.version }} @@ -90,6 +92,7 @@ jobs: uses: ./.github/workflows/bundle-desktop-windows.yml permissions: id-token: write + contents: read with: version: ${{ needs.prepare-version.outputs.version }} signing: false diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index dc30ec4925cb..dc7f03815a58 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -122,6 +122,7 @@ jobs: uses: ./.github/workflows/bundle-desktop.yml permissions: id-token: write + contents: read needs: changes if: (github.event_name == 'pull_request' || github.event_name == 'merge_group') && (needs.changes.outputs.code == 'true' || github.event_name != 'pull_request') with: diff --git a/.github/workflows/pr-comment-bundle-intel.yml b/.github/workflows/pr-comment-bundle-intel.yml index 97873aa57db9..cc15cfd842a4 100644 --- a/.github/workflows/pr-comment-bundle-intel.yml +++ b/.github/workflows/pr-comment-bundle-intel.yml @@ -65,6 +65,7 @@ jobs: uses: ./.github/workflows/bundle-desktop-intel.yml permissions: id-token: write + contents: read with: signing: false ref: ${{ needs.trigger-on-command.outputs.head_sha }} diff --git a/.github/workflows/pr-comment-bundle-windows.yml b/.github/workflows/pr-comment-bundle-windows.yml index 17ebf78a2d64..8b4077cae30c 100644 --- a/.github/workflows/pr-comment-bundle-windows.yml +++ b/.github/workflows/pr-comment-bundle-windows.yml @@ -68,6 +68,7 @@ jobs: uses: ./.github/workflows/bundle-desktop-windows.yml permissions: id-token: write + contents: read with: signing: false ref: ${{ needs.trigger-on-command.outputs.head_sha }} diff --git a/.github/workflows/pr-comment-bundle.yml b/.github/workflows/pr-comment-bundle.yml index 3e1be17ef7fb..3aff2021e77f 100644 --- a/.github/workflows/pr-comment-bundle.yml +++ b/.github/workflows/pr-comment-bundle.yml @@ -109,6 +109,7 @@ jobs: uses: ./.github/workflows/bundle-desktop.yml permissions: id-token: write + contents: read with: signing: false ref: ${{ needs.trigger-on-command.outputs.pr_sha }} diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 77afe20306fe..166edcfecc7e 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -46,6 +46,7 @@ jobs: uses: ./.github/workflows/bundle-desktop.yml permissions: id-token: write + contents: read with: signing: true secrets: @@ -58,6 +59,7 @@ jobs: uses: ./.github/workflows/bundle-desktop-intel.yml permissions: id-token: write + contents: read with: signing: true secrets: @@ -70,6 +72,7 @@ jobs: uses: ./.github/workflows/bundle-desktop-linux.yml permissions: id-token: write + contents: read # # ------------------------------------------------------------ # # 6) Bundle Desktop App (Windows) @@ -78,6 +81,7 @@ jobs: uses: ./.github/workflows/bundle-desktop-windows.yml permissions: id-token: write + contents: read with: signing: true secrets: From 6984b7dc2d9a0ae0b08dde09bab550da59cc41ec Mon Sep 17 00:00:00 2001 From: Jack Amadeo Date: Fri, 1 Aug 2025 10:11:43 -0400 Subject: [PATCH 3/3] revert for non-macos --- .github/workflows/canary.yml | 6 ------ .github/workflows/pr-comment-bundle-windows.yml | 3 --- .github/workflows/release.yml | 6 ------ 3 files changed, 15 deletions(-) diff --git a/.github/workflows/canary.yml b/.github/workflows/canary.yml index 0dbf33e70d75..dfe0436912d3 100644 --- a/.github/workflows/canary.yml +++ b/.github/workflows/canary.yml @@ -78,9 +78,6 @@ jobs: bundle-desktop-linux: needs: [prepare-version] uses: ./.github/workflows/bundle-desktop-linux.yml - permissions: - id-token: write - contents: read with: version: ${{ needs.prepare-version.outputs.version }} @@ -90,9 +87,6 @@ jobs: bundle-desktop-windows: needs: [prepare-version] uses: ./.github/workflows/bundle-desktop-windows.yml - permissions: - id-token: write - contents: read with: version: ${{ needs.prepare-version.outputs.version }} signing: false diff --git a/.github/workflows/pr-comment-bundle-windows.yml b/.github/workflows/pr-comment-bundle-windows.yml index 8b4077cae30c..e966d2af07d9 100644 --- a/.github/workflows/pr-comment-bundle-windows.yml +++ b/.github/workflows/pr-comment-bundle-windows.yml @@ -66,9 +66,6 @@ jobs: needs: [trigger-on-command] if: ${{ needs.trigger-on-command.outputs.continue == 'true' }} uses: ./.github/workflows/bundle-desktop-windows.yml - permissions: - id-token: write - contents: read with: signing: false ref: ${{ needs.trigger-on-command.outputs.head_sha }} diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 166edcfecc7e..a475db4c48c7 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -70,18 +70,12 @@ jobs: # ------------------------------------------------------------ bundle-desktop-linux: uses: ./.github/workflows/bundle-desktop-linux.yml - permissions: - id-token: write - contents: read # # ------------------------------------------------------------ # # 6) Bundle Desktop App (Windows) # # ------------------------------------------------------------ bundle-desktop-windows: uses: ./.github/workflows/bundle-desktop-windows.yml - permissions: - id-token: write - contents: read with: signing: true secrets: