-
Notifications
You must be signed in to change notification settings - Fork 0
fix(dependency-review): reusable workflow causes caller startup_failure #1733
Copy link
Copy link
Closed as duplicate
Closed as duplicate
Copy link
Labels
area: ci-cdCI, GitHub Actions, checks, release, or supply chainCI, GitHub Actions, checks, release, or supply chainarea: securitySecurity boundary, hardening, or vulnerability preventionSecurity boundary, hardening, or vulnerability preventionbugSomething isn't workingSomething isn't workingpriority: highHigh-priority or P1 workHigh-priority or P1 workstatus: blockedBlocked by conflict, dependency, or required prerequisiteBlocked by conflict, dependency, or required prerequisitetype: bugDefect or incorrect behaviorDefect or incorrect behavior
Description
Activity
Metadata
Metadata
Assignees
Labels
area: ci-cdCI, GitHub Actions, checks, release, or supply chainCI, GitHub Actions, checks, release, or supply chainarea: securitySecurity boundary, hardening, or vulnerability preventionSecurity boundary, hardening, or vulnerability preventionbugSomething isn't workingSomething isn't workingpriority: highHigh-priority or P1 workHigh-priority or P1 workstatus: blockedBlocked by conflict, dependency, or required prerequisiteBlocked by conflict, dependency, or required prerequisitetype: bugDefect or incorrect behaviorDefect or incorrect behavior
Superseded by existing canonical owner repair
Fresh owner-path search after opening this issue found the already-existing canonical
.githubrepair PR#1725, which has independently reproduced this exact failure class on newsdom-api and mightyETL and identifies the causal defect: reusable workflows cannot elevate the caller'sGITHUB_TOKENpermission envelope. Consumer callers that omittedcontents: read+pull-requests: readterminatestartup_failurewith zero jobs.Naruon
#1539@6e7a8d8a947fec1ffdfff15f165b3a171ec2e03eis now added as a fifth exact reproduction on#1725, and the Naruon consumer PR has been given the minimal caller-side repair/verification criteria.This issue adds no unique remaining delta beyond
#1725; keeping a duplicate owner issue would split provenance. Close as duplicate only because the existing canonical owner PR fully owns the same root cause, RED/GREEN contract, immutable publication requirement, and consumer revalidation path.Canonical owner: #1725
Affected consumer: ContextualWisdomLab/naruon#1539
Exact failed run: naruon
33630975578on6e7a8d8a947fec1ffdfff15f165b3a171ec2e03e.