From b27cb5a9fa8a320bd3566558097af9aa0e58cfa6 Mon Sep 17 00:00:00 2001 From: Guillaume Lours Date: Wed, 5 Aug 2026 12:28:16 +0200 Subject: [PATCH] ci: grant actions:write to PR review workflow docker-agent-action v2.0.3 raised the review job's required permission from actions:read to actions:write (cache delete for review-lock release, feedback artifact management). GitHub refuses to start a reusable workflow requesting more permissions than the caller grants, so every PR Review run since the v2.0.3 bump ended in startup_failure and docker-agent stopped launching automatically. Signed-off-by: Guillaume Lours --- .github/workflows/pr-review.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/pr-review.yml b/.github/workflows/pr-review.yml index 8c1259c1ca..0c3800539c 100644 --- a/.github/workflows/pr-review.yml +++ b/.github/workflows/pr-review.yml @@ -26,7 +26,7 @@ jobs: issues: write # Create security incident issues if secrets detected checks: write # (Optional) Show review progress as a check run id-token: write # Required for OIDC authentication to AWS Secrets Manager - actions: read # Download artifacts from trigger workflow + actions: write # Download artifacts from trigger workflow; cache delete for review-lock release (required since docker-agent-action v2.0.3) with: trigger-run-id: ${{ github.event_name == 'workflow_run' && format('{0}', github.event.workflow_run.id) || '' }}