Grant packages:write to Ruby build workflows for manual dispatch#92
Merged
Conversation
workflow_dispatch runs are capped at the repo's default token permissions (packages: read), so manually triggering these workflows to publish images failed with a permissions error on the nested _build-image.yml job requesting packages: write. main.yml already grants packages: write at the job level when calling these as reusable workflows via push, so this only adds the missing grant for the workflow_dispatch path.
eregon
approved these changes
Jul 17, 2026
lloeki
approved these changes
Jul 17, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
permissions: packages: writeat the top level ofruby.yml,build-ruby.yml, andbuild-ruby-compilers.yml.workflow_dispatch(e.g. to publish images withpush: true) currently fails, becauseworkflow_dispatchruns are capped at the repo's default token permissions (packages: read), and the nested_build-image.ymljob requestspackages: write.main.ymlalready grantspackages: writeat the job level when calling these as reusable workflows onpush, so this only fills the gap for the manual dispatch path — no change to existing push-triggered behavior.These permissions: blocks are declared at the job level inside the reusable workflow _build-image.yml. Each job runs steps that log in to the container registry and push images/manifests (e.g. docker push, docker manifest push for the multiarch release tag) — hence they explicitly request packages: write.
GitHub enforces that a caller workflow's effective token permissions must be at least as permissive as what a nested/reusable workflow's jobs request. Since ruby.yml → build-ruby.yml → _build-image.yml had no permissions: block declared anywhere in the caller chain when triggered via workflow_dispatch, GitHub fell back to the repo's default (packages: read), which is less than the packages: write these two jobs explicitly require — causing the startup failure. That's the gap PR #92 closes by adding permissions: packages: write to the caller workflows.
Failed run
Dispatching
Rubymanually withpush: truefails immediately with a startup failure:https://github.com/DataDog/images-rb/actions/runs/29567133724