fix: Add contents:write to Comet CI for release asset uploads#239
Conversation
|
@copilot rebase this PR |
Done — rebased onto |
There was a problem hiding this comment.
Pull request overview
This PR updates GitHub Actions workflows to address permission-related 403 failures during GitHub release asset uploads and to avoid failing commit-status posting on fork PRs.
Changes:
- Grants the Comet CI workflow
contents: writepermissions sogh release uploadcan attach.nupkgassets to published releases. - Skips the “Post evaluation commit status” step in the skill evaluation workflow when the PR comes from a fork (where
GITHUB_TOKENcannot write commit statuses).
Reviewed changes
Copilot reviewed 11 out of 11 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| .github/workflows/skill-evaluation.yml | Adds a fork-PR guard to avoid 403s when attempting to write commit statuses. |
| .github/workflows/ci-comet.yml | Adds contents: write permissions to enable release asset uploads from the workflow. |
Expert Code Review — PR #239Methodology: 3 independent reviewers with adversarial consensus Result: 2 findings posted as inline comments (2 moderate) CI Status
Test CoverageThis PR modifies only GitHub Actions workflow YAML files — no application code or tests are affected. No test changes are needed. Discarded FindingsThe following were flagged by a single reviewer but did not reach consensus:
|
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Expert Code Review: 2 findings posted inline. See the lean summary comment for full details.
Generated by Expert Code Review (auto) for issue #239 · ● 3.8M
jfversluis
force-pushed
the
fix/comet-release-permissions
branch
from
3a4b736 to
157ddf6
Compare
Scoped to the package job only (least-privilege). Build job retains default read-only permissions. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
jfversluis
force-pushed
the
fix/comet-release-permissions
branch
from
157ddf6 to
10d3a0a
Compare
…239) Scoped to the package job only (least-privilege). Build job retains default read-only permissions. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: jfversluis <939291+jfversluis@users.noreply.github.com>
Release asset uploads fail with 403 because the workflow lacks
contents: writepermission.