From 2255e3a47bf2ac832f5a641a349155f43abeaf69 Mon Sep 17 00:00:00 2001 From: Jimisola Laursen Date: Sun, 16 Aug 2026 19:12:05 +0200 Subject: [PATCH] fix(ci): grant pull-requests: read to the semantic-PR check The workflow granted contents: read, but common-check-semantic-pr.yml needs pull-requests: read to inspect the PR title -- and a callee may not request more than it is granted, so the run was rejected before any job started. This is the second half of the fix: the earlier change repointed the reference from a pinned SHA that predates the file to @main, which resolved the workflow; this grants it the permission it actually needs. Between the two, PR titles have not been validated in this repo since the reference broke. Signed-off-by: Jimisola Laursen --- .github/workflows/check-semantic-pr.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/check-semantic-pr.yml b/.github/workflows/check-semantic-pr.yml index b0ce8b2..d2bd380 100644 --- a/.github/workflows/check-semantic-pr.yml +++ b/.github/workflows/check-semantic-pr.yml @@ -6,7 +6,9 @@ on: types: [opened, edited, synchronize, reopened] permissions: - contents: read + # The callee reads PR metadata to validate the title; contents is not enough, + # and a callee may not request more than it is granted. + pull-requests: read jobs: check: