From c1ee56d6d0c99edd79fc63deffa3e84711671b81 Mon Sep 17 00:00:00 2001 From: Tobias Fischer Date: Sat, 10 Oct 2026 11:19:02 +1000 Subject: [PATCH] Generated build jobs: contents: read next to id-token Jobs that declare permissions get none they don't list, so the generated build jobs (id-token: write, attestations: write) had no contents permission; checking out only worked because the repository is public. rs gha adds contents: read to every job and refuses a job with permissions without it. Closes #38: the other half, tokens on the command line, went with #46. Co-Authored-By: Claude Opus 5.5 --- tools/robostack.py | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/tools/robostack.py b/tools/robostack.py index 46015061..745ecf6f 100644 --- a/tools/robostack.py +++ b/tools/robostack.py @@ -325,6 +325,12 @@ def generate_gha(distro: str, args: list[str]) -> int: lines = [f"name: build\nrun-name: {distro} {ns.platform}" if l.startswith("name: ") else l for l in lines] # uploads use prefix.dev trusted publishing only: no anaconda.org token lines = [l for l in lines if "ANACONDA_API_TOKEN" not in l] + # jobs that declare permissions get none they don't list: checking out the + # repository needs contents: read (only works without it while it is public) + lines = [f"{l}\n{l[:len(l) - len(l.lstrip())]}contents: read" if l.strip() == "id-token: write" else l + for l in lines] + if sum("permissions:" in l for l in lines) != sum("contents: read" in l for l in lines): + raise SystemExit(f"{wf}: a job with permissions but without contents: read") if ns.platform == "win-64" and not any("build-ci" in l for l in lines): raise SystemExit(f"{wf}: the Windows workflow doesn't use .scripts/build_win.bat") if any(l.startswith("env:") for l in lines):