From 81a96bfed2df0e8ee4c985b7154adb03ca8d284c Mon Sep 17 00:00:00 2001 From: Marcel Wege Date: Mon, 27 Jul 2026 06:00:14 +0200 Subject: [PATCH] fix(ci): grant id-token: write to release.yml's edge-images job MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit publish-images.yml (the reusable image-publish workflow) declares 'id-token: write' for keyless cosign signing (spec §10), but a reusable workflow cannot self-grant that permission -- the calling job must. auto-release.yml's publish-images job already grants it correctly; the edge-images job in release.yml (push-to-main -> :edge + :sha-) was never updated when that requirement was added, so GitHub rejects the workflow file at parse time with: Error calling workflow '.../publish-images.yml@'. The workflow is requesting 'id-token: write', but is only allowed 'id-token: none'. This has failed (startup_failure) on every push to main since 2026-07-12 (c627c3c) -- no :edge Docker image has published since. Mirrors the exact permission + comment already used in auto-release.yml's publish-images job. --- .github/workflows/release.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index d997027a1..b77502f60 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -28,6 +28,10 @@ jobs: permissions: contents: read packages: write + # Keyless cosign signing of the dev-runner release image (spec §10): the + # reusable workflow signs with the workflow's GitHub OIDC token, so the + # CALLER must grant id-token here — a reusable workflow cannot self-grant it. + id-token: write # No `version` input -> edge build (:edge + :sha-) from this commit. uses: ./.github/workflows/publish-images.yml