fix(ci): grant contents:write to AWS deploy workflow chain#184
Merged
Conversation
The 1.0.0 release fired Static Deployment on master and it failed
with `startup_failure` immediately — the called
`0xPolygon/pipelines/.github/workflows/ecs_deploy_docker_taskdef.yaml`
declares `permissions: { id-token: write, contents: write }` on its
job, but PR #182 hardened the trigger with `contents: read`, which is
not a superset of what the called workflow needs.
Both deployment.yml and build_and_deploy.yml now declare
`contents: write`. id-token: write is unchanged. The token is still
scoped down from `inherit`-everything to just the two scopes the AWS
deploy actually uses.
|
Code reviewNo issues found. Checked for bugs and CLAUDE.md compliance. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Hotfix for Static Deployment run 25907576431 which failed at startup on the merge of #183 (changesets-release for
@polygonlabs/meta@1.0.0).PR #182 hardened
deployment.ymlandbuild_and_deploy.ymlwith explicit top-levelpermissions: { contents: read, id-token: write }to replace the previoussecrets: inherit/ no-permissions defaults. That's not a superset of what the called shared workflow needs —0xPolygon/pipelines/.github/workflows/ecs_deploy_docker_taskdef.yamldeclarespermissions: { id-token: write, contents: write }on itsdeploy_workflowjob — so GitHub Actions failed at workflow startup before any step ran.Both calling workflows now declare
contents: write.id-token: writeis unchanged. The token is still scoped down to just the two scopes the AWS deploy actually uses — it's not a regression back toinherit-everything.Test plan
master) and verifyStatic Deploymentreaches thedeployjob and completes 1.0.0's ECS rollout.