fix(ci): grant actions:read and contents:read to E2E label helper#995
Merged
fix(ci): grant actions:read and contents:read to E2E label helper#995
Conversation
Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>
|
Label |
The helper calls gh api .../branches/<ref> and gh api .../actions/workflows/<file>/runs. Both endpoints need read permissions the workflow did not declare. Without them the runs lookup silently returned empty, and the helper fell back to linking the workflow's all-runs page instead of the specific run for the PR head SHA. Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>
pimlock
changed the title
When the workflow runs lookup returns no specific run id, the comment now tells the maintainer to find the run by commit SHA on the workflow page instead of just linking to the all-runs page with no further guidance. Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>
TaylorMutch
approved these changes
Apr 28, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The
E2E Label Helpworkflow'sgh apicalls silently failed permission checks. The job had onlypull-requests: write, but it also calls:gh api repos/<repo>/branches/<ref>(needscontents: read)gh api repos/<repo>/actions/workflows/<file>/runs(needsactions: read)Without those, the workflow-runs lookup returned empty and the helper fell back to linking the all-runs page for the workflow instead of the specific run for the PR head SHA. Posting comments still worked because that uses
pull-requests: write.Spotted while testing #990 by re-applying
test:e2eto this PR and observing the comment linked to the workflow's all-runs page rather than the run for this PR's SHA. The samegh api .../runs?head_sha=<sha>call returns the run when run locally with a PAT.Also includes a tiny CI.md wording tweak from the original test commit ("stays neutral" → "passes as a no-op", since the gate's no-label path exits 0 / green, not neutral).
Changes
.github/workflows/e2e-label-help.yml- addactions: readandcontents: readto thehintjob.architecture/ci-e2e.md- update the permissions table to match.CI.md- clarify gate-with-no-label state.Testing
pull_request_targetworkflow files are loaded from the base branch (main), so the fix only takes effect after this PR merges. Verification on a future PR:test:e2e, confirm theE2E Label Helpcomment links to the specificBranch E2E Checksrun for the PR head SHA, not the workflow's all-runs page.test:e2ebefore copy-pr-bot mirrors the PR, confirm the comment instead tells the maintainer to run/ok to test <SHA>.Checklist