Repository navigation
fix(release): Auto Release fails at startup; give the prepare call the ceiling its called file declares - #449
Merged
Conversation
…declares Every Auto Release run since c16c5f9 ends in startup_failure: the called trusted-release.yml declares github-release with contents: write and packages: write, and GitHub rejects a caller ceiling of contents: read for the whole file. 0.137.0 (#447) and #448 never published. The prepare job still runs on the file's top-level contents: read token.
tangletools
approved these changes
Oct 25, 2026
tangletools
left a comment
tangletools
left a comment
Contributor
There was a problem hiding this comment.
✅ Auto-approved PR — 362cf3ba
Blanket team auto-approval is intentional. This is not a code review.
No automated review runs on this PR. This approval rests on the rule above alone.
tangletools · auto-approval · reason: blanket_auto_approve · 2026-10-25T16:50:17Z
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem. Every Auto Release & Publish run since c16c5f9 (10-23) ends in
startup_failure(runs on 1419d6b, edd99e4, 421586a).package.jsonon main says 0.137.0; npm latest is 0.136.1, so #447 and #448 never shipped.Cause.
release.ymlcalls the pinnedtrusted-release.yml@ab33b2etwice. That file declares agithub-releasejob withcontents: write, packages: write. GitHub validates every job in a called file against the caller's ceiling, including jobs thephaseinput skips, and thepreparecall grants onlycontents: read, so the run is rejected before any job starts.Change. The
preparecall's ceiling becomescontents: write, packages: write. The prepare job itself declares no job-level permissions, so it still gets the file's top-levelcontents: readtoken.Proof after merge.
gh workflow run release.ymlon main; the run must start, publish 0.137.0 to npm and create the GitHub release.Run ID: run_369e8dcc6188e337ad6eda9097f3a5e9