ci: add permissions to release-sdk caller job#32
Merged
Conversation
The release-please workflow fails with startup_failure because the caller job invoking publish.yml does not declare explicit permissions. This causes the reusable workflow's permission requirements to exceed the restricted defaults. Co-Authored-By: rlamb@launchdarkly.com <4955475+kinyoklion@users.noreply.github.com>
Contributor
🤖 Devin AI EngineerI'll be helping with this pull request! Here's what you should know: ✅ I will automatically:
Note: I can only respond to comments from users who have write access to this repository. ⚙️ Control Options:
|
jsonbailey
approved these changes
May 14, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Requirements
Related issues
Fixes Release Please
startup_failurethat has been occurring since the org added explicit permissions to release-please workflows.Describe the solution you've provided
Adds explicit
permissionsto therelease-sdkcaller job that invokespublish.ymlas a reusable workflow. Without these permissions, the reusable workflow's permission declarations exceed the restricted defaults, causing GitHub to reject the workflow at startup.Describe alternatives you've considered
Moving publish steps inline (as done in ruby-server-sdk) would also fix this, but is a larger change.
Additional context
Same fix pattern applied in dotnet-core (PR #241) on April 8 which resolved the identical startup_failure there.
Link to Devin session: https://app.devin.ai/sessions/54e32482848742c19ebf9c374efdc833
Requested by: @kinyoklion
Note
Low Risk
Low risk workflow-only change; it only expands the job token permissions needed for the release publish step and does not affect application code.
Overview
Fixes Release Please workflow
startup_failureby adding explicit permissions to therelease-sdkjob that calls the reusablepublish.ymlworkflow.The caller job now grants
id-token: write,contents: write, andattestations: writeso the reusable workflow’s required permissions are not rejected by GitHub’s default restricted token.Reviewed by Cursor Bugbot for commit b146f92. Bugbot is set up for automated code reviews on this repo. Configure here.