Skip to content

ci: drop the unused statuses scope from the maintainer approval gate - #80

Merged
imran-siddique merged 1 commit into
mainfrom
fix/workflow-token-permissions
Sep 26, 2026
Merged

imran-siddique merged 1 commit into
mainfrom
fix/workflow-token-permissions

Conversation

@imran-siddique

Copy link
Copy Markdown
Member

require-maintainer-approval.yml granted statuses: write, which the gate never uses. It reads the PR and its reviews and fails the job when no maintainer approved the head commit. The job now gets contents: read and pull-requests: read, the same form agent-manifest already runs, and the workflow default stays contents: read. Scorecard flagged this file in trace-registry (#95) and weight-custody-manifest (#165); this is the same change here.

The file parses, and the approval gate runs on this PR under the new permissions.

Generated with Claude Code

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@imran-siddique
imran-siddique merged commit 96316f1 into main Sep 26, 2026
4 checks passed
@imran-siddique
imran-siddique deleted the fix/workflow-token-permissions branch September 26, 2026 03:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant