Repository navigation
ci(release): the gates job grants id-token: write, so v0.1.0-preview.10 can be cut - #139
Merged
Merged
Conversation
A called workflow's jobs get no more than the caller grants, and a run whose called job asks for more never starts. #134 gave ci.yml's container job id-token: write (a972638), which release.yml's gates job did not grant, so every Release run since, on land/release-v0.1.0-preview.10 and on main, ended in startup_failure and v0.1.0-preview.10 was not cut. Every other ci.yml job asks for contents: read and packages: read or write, within what gates grants. Refs #134 Refs #89 Signed-off-by: Emil Okkels Klein <hannibal.okkels@gmail.com> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014BgePW3C3ECWERkiQMVdPb
Owner
Author
|
approve e95d4c0 |
Owner
Author
|
approve e95d4c0 |
Owner
Author
|
The A re-run of the failed job should clear the judge. I can't trigger one myself: the Actions API answers this session with Generated by Claude Code |
Hafeok
added a commit
that referenced
this pull request
Oct 21, 2026
…t maintenance Refs #110 Signed-off-by: Emil Okkels Klein <hannibal.okkels@gmail.com> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014BgePW3C3ECWERkiQMVdPb
9 of 10 tasks
Hafeok
added a commit
that referenced
this pull request
Oct 21, 2026
main moved 15 commits, among them milestone Extent maintenance (#110), which adds store tests: ExtentMergeTests and ObjectReaderScheduleTests in process, and the extent maintenance legs against Azurite and RustFS in storage (services). The pull request could not merge, so CI did not run on ac143f8. One conflict: docs/testing.md gained section 7 on main (Extent maintenance) and here (how long the tests take); main's keeps 7, this one becomes 8, and the nightly workflow's references follow it. The next run is the baseline for Extent maintenance's tests in the store step, as #126 asks when that milestone lands first. Refs #126 Signed-off-by: Emil Okkels Klein <hannibal.okkels@gmail.com> Co-Authored-By: Claude <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YWZaiBxSK7r6aizeG5YWo3
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A one-line fix to
release.yml, for the release of #134. No release descriptor.What this changes, and why
startup_failure: run 31 onland/release-v0.1.0-preview.10and run 32 onmain, both at 02a7f5a. Sov0.1.0-preview.10was never cut.release.yml's own comment says so. Management plane, part 1: the fleet system dataset, grants as code, varve apply (v0.1.0-preview.10) #134 (a972638) gaveci.yml'scontainerjobid-token: write, which it presents to the test issuer as its client assertion. Thegatesjob grants onlycontents: readandpackages: write.gatesnow also grantsid-token: write, and its comment notes Management plane, part 1: the fleet system dataset, grants as code, varve apply (v0.1.0-preview.10) #134'scontainerjob.Refs #134, #89. #135 waits on this: it can't land while two release descriptors are pending.
What was measured
I read every job in
ci.yml. The workflow default iscontents: read, and these jobs set their own permissions:auth-mock-oauth2,storage-services,fleet-services,auth-zitadel,aspire,samples-eventhubscontents: read,packages: readcontainercontents: read,packages: write,id-token: writeNo other job sets permissions. After this change none asks for more than
gatesgrants, and no other job needs listing. The onlyuses: ./steps inci.ymlare thetools/repo-standardaction, which can't widen permissions.Run locally on the branch:
eng/required-checks.cs,eng/issue-refs.cs,eng/dco.csandeng/release.cs -- --checkall pass. The YAML parses.What was found
Nothing else.
What is left
mainwithdry_run: falseto cutv0.1.0-preview.10.v0.1.0-preview.11, after mergingmain.Checklist
Refs #134andRefs #89, with no closing keyword.mainafter landing is the test.docs/traceability/2026-10-19-issue-110-extent-maintenance.md, on Extent maintenance: background merges and extent deletion (v0.1.0-preview.11) #135).dotnet run eng/ci.cspasses locally: not run; the change is torelease.ymlalone, whichci.csdoes not run.Generated by Claude Code