From 9475ec3a484356f45599edadfcce039d7625f1c3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jo=C3=ABl?= Date: Tue, 4 Aug 2026 07:11:37 +0200 Subject: [PATCH] ci: grant contents:read so checkout works on this private fork --- .github/workflows/build.yml | 9 ++++++++- .github/workflows/build_enterprise.yml | 6 +++++- .github/workflows/danger.yml | 6 +++++- .github/workflows/maestro-local.yml | 6 +++++- .github/workflows/quality.yml | 10 +++++++++- .github/workflows/recordScreenshots.yml | 6 +++++- .github/workflows/sonar.yml | 6 +++++- .github/workflows/tests.yml | 6 +++++- .github/workflows/validate-lfs.yml | 6 +++++- 9 files changed, 52 insertions(+), 9 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 99b5ce9ef0..af67604b3c 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -7,7 +7,11 @@ on: push: branches: [ develop ] -permissions: {} +permissions: + # Private fork: actions/checkout needs contents:read to clone. Upstream is public, + # where an empty token can still read the repo, so an empty permissions block works there and + # fails here with `fatal: repository not found`. + contents: read # Enrich gradle.properties for CI/CD env: @@ -19,6 +23,9 @@ jobs: name: Build APKs runs-on: ubuntu-latest permissions: + # A job-level block replaces the workflow-level one, so contents:read has to be + # repeated here or checkout fails on this private fork. + contents: read # For NejcZdovc/comment-pr pull-requests: write strategy: diff --git a/.github/workflows/build_enterprise.yml b/.github/workflows/build_enterprise.yml index c176864b46..4f447aafab 100644 --- a/.github/workflows/build_enterprise.yml +++ b/.github/workflows/build_enterprise.yml @@ -7,7 +7,11 @@ on: push: branches: [ develop ] -permissions: {} +permissions: + # Private fork: actions/checkout needs contents:read to clone. Upstream is public, + # where an empty token can still read the repo, so an empty permissions block works there and + # fails here with `fatal: repository not found`. + contents: read # Enrich gradle.properties for CI/CD env: diff --git a/.github/workflows/danger.yml b/.github/workflows/danger.yml index a8bf7b623a..ce1a792227 100644 --- a/.github/workflows/danger.yml +++ b/.github/workflows/danger.yml @@ -2,7 +2,11 @@ name: Danger CI on: [pull_request, merge_group] -permissions: {} +permissions: + # Private fork: actions/checkout needs contents:read to clone. Upstream is public, + # where an empty token can still read the repo, so an empty permissions block works there and + # fails here with `fatal: repository not found`. + contents: read jobs: build: diff --git a/.github/workflows/maestro-local.yml b/.github/workflows/maestro-local.yml index 558d1b0a0c..f28e9951be 100644 --- a/.github/workflows/maestro-local.yml +++ b/.github/workflows/maestro-local.yml @@ -5,7 +5,11 @@ on: workflow_dispatch: pull_request: -permissions: {} +permissions: + # Private fork: actions/checkout needs contents:read to clone. Upstream is public, + # where an empty token can still read the repo, so an empty permissions block works there and + # fails here with `fatal: repository not found`. + contents: read # Enrich gradle.properties for CI/CD env: diff --git a/.github/workflows/quality.yml b/.github/workflows/quality.yml index b73a247347..22bfb72f61 100644 --- a/.github/workflows/quality.yml +++ b/.github/workflows/quality.yml @@ -7,7 +7,11 @@ on: push: branches: [ main, develop ] -permissions: {} +permissions: + # Private fork: actions/checkout needs contents:read to clone. Upstream is public, + # where an empty token can still read the repo, so an empty permissions block works there and + # fails here with `fatal: repository not found`. + contents: read # Enrich gradle.properties for CI/CD env: @@ -331,6 +335,10 @@ jobs: name: Run zizmor runs-on: ubuntu-latest permissions: + # A job-level block replaces the workflow-level one, so contents:read has to be + # repeated here or checkout fails on this private fork. + contents: read + actions: read # Required for zizmor to read workflow files. security-events: write # Required for upload-sarif (used by zizmor-action) to upload SARIF files. steps: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 diff --git a/.github/workflows/recordScreenshots.yml b/.github/workflows/recordScreenshots.yml index 7465a6d6f8..811b613088 100644 --- a/.github/workflows/recordScreenshots.yml +++ b/.github/workflows/recordScreenshots.yml @@ -5,7 +5,11 @@ on: pull_request: types: [ labeled ] -permissions: {} +permissions: + # Private fork: actions/checkout needs contents:read to clone. Upstream is public, + # where an empty token can still read the repo, so an empty permissions block works there and + # fails here with `fatal: repository not found`. + contents: read # Enrich gradle.properties for CI/CD env: diff --git a/.github/workflows/sonar.yml b/.github/workflows/sonar.yml index 4cb6bddf39..05600a524d 100644 --- a/.github/workflows/sonar.yml +++ b/.github/workflows/sonar.yml @@ -7,7 +7,11 @@ on: push: branches: [ main, develop ] -permissions: {} +permissions: + # Private fork: actions/checkout needs contents:read to clone. Upstream is public, + # where an empty token can still read the repo, so an empty permissions block works there and + # fails here with `fatal: repository not found`. + contents: read # Enrich gradle.properties for CI/CD env: diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index 5466bc80af..60032d50fb 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -7,7 +7,11 @@ on: push: branches: [ main, develop ] -permissions: {} +permissions: + # Private fork: actions/checkout needs contents:read to clone. Upstream is public, + # where an empty token can still read the repo, so an empty permissions block works there and + # fails here with `fatal: repository not found`. + contents: read # Enrich gradle.properties for CI/CD env: diff --git a/.github/workflows/validate-lfs.yml b/.github/workflows/validate-lfs.yml index 027c7d68e9..45c8fb8d29 100644 --- a/.github/workflows/validate-lfs.yml +++ b/.github/workflows/validate-lfs.yml @@ -2,7 +2,11 @@ name: Validate Git LFS on: [pull_request, merge_group] -permissions: {} +permissions: + # Private fork: actions/checkout needs contents:read to clone. Upstream is public, + # where an empty token can still read the repo, so an empty permissions block works there and + # fails here with `fatal: repository not found`. + contents: read jobs: build: