[yordis]

• CI Go, CI Proto and CodeQL fail at startup on main since ci(runner): read self-hosted runners as TrogonStack Baton #975: GitHub checks a caller's permissions against every job of the called workflow, including the runner job these callers skip.
• The grant reads no key on its own: Google only admits ci-selection.yml on main through the github-app-baton environment, which only the runner job declares.

---

Note

Low Risk
GitHub Actions permission alignment only; callers still do not run the Baton/GCP steps that consume the token.

Overview
Fixes CI Go, CI Proto, and CodeQL failing to start when they call ci-selection.yml, by granting id-token: write on each workflow’s changes reusable-workflow job (matching what CI Rust already had).

GitHub compares the caller’s job permissions to every job in the called workflow—including the optional runner job these suites skip—so missing id-token: write blocked the whole run even though those callers never execute Baton/GCP steps.

The workflow tests now assert all selection callers expose id-token: write, with a comment documenting this GitHub behavior.

^{Reviewed by Cursor Bugbot for commit fc0ea27. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

No actionable comments were generated in the recent review.

Walkthrough

Three GitHub Actions workflows now grant id-token: write to their changes jobs. The CI-selection test now expects that permission for every suite.

Changes

Caller workflow permissions

Layer / File(s)	Summary
Update caller permissions and test expectations .github/workflows/ci-go.yml, .github/workflows/ci-proto.yml, .github/workflows/codeql.yml, tests/github_actions/test_ci_selection.mjs	The three changes jobs add id-token: write. The CI-selection test now checks for that permission across all suites.

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Possibly related PRs

• TrogonStack/trogonai#972: Adds the runner-job permission requirement that these caller workflows now satisfy.

Merge Risk: Minimal · up to fc0ea

The change lets the CI Go, CI Proto and CodeQL workflows start again by granting the permission that GitHub checks for the called workflow. No actionable merge-blocking risk remains.

Pre-merge checks: 4

Check name	Status	Explanation
Title check		The title names the fix and its scope: it lets every CI selection caller start the runner job. The raw summary shows the change adds id-token: write to the changes job in ci-go.yml, ci-proto.yml, code…
Description check		The description states the problem: CI Go, CI Proto, and CodeQL fail at startup because GitHub checks a caller's permissions against every job in the called workflow, including the skipped runner job.…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Title check

Explanation

The title names the fix and its scope: it lets every CI selection caller start the runner job. The raw summary shows the change adds id-token: write to the changes job in ci-go.yml, ci-proto.yml, codeql.yml, and the matching test expectation. The title covers the main change, though it does not name the permission grant itself.

Full details: Description check

Explanation

The description states the problem: CI Go, CI Proto, and CodeQL fail at startup because GitHub checks a caller's permissions against every job in the called workflow, including the skipped runner job. It also explains why the id-token grant is needed for the Google environment admission. This matches the id-token: write changes in the summary.

Finishing Touches

Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks each workflow line,
And finds the token grant in place.
The tests now check each suite for it,
No skipped job escapes the trace.
Then off the rabbit hops, content.}

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 6fcd5bc7-1b08-4dc9-ac11-5135af2c865f

Commits

Reviewing files that changed from the base of the PR and between 9c70ad7 and fc0ea27.

Files selected for processing: 4

• .github/workflows/ci-go.yml
• .github/workflows/ci-proto.yml
• .github/workflows/codeql.yml
• tests/github_actions/test_ci_selection.mjs

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.