[PR #64] [MERGED] fix(groom): correct required caller permissions in ci-groom, header, README (BE-3873) #73

New issue

Closed

opened 2026-10-26 22:35:56 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-26 22:35:56 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/Comfy-Org/github-workflows/pull/64
Author: @mattmillerai
Created: 7/23/2026
Status: ✅ Merged
Merged: 7/23/2026
Merged by: @mattmillerai

Base: main ← Head: matt/be-3873-groom-caller-permissions-doc

📝 Commits (2)

34aa7dd fix(groom): correct required caller permissions in ci-groom, header, README (BE-3873)
8ac0241 fix(groom): grant id-token:write for claude-code-action OIDC in agent jobs + callers (BE-3873)

📊 Changes

3 files changed (+33 additions, -9 deletions)

View changed files

📝 .github/workflows/ci-groom.yml (+11 -3)
📝 .github/workflows/groom.yml (+21 -5)
📝 README.md (+1 -1)

📄 Description

What

Fixes the groom caller permissions documentation + the self-pilot caller so groom callers can actually start.

Why

A groom dry-run dispatch startup-failed (0 jobs) with:

The nested job 'file' is requesting 'issues: write', but is only allowed 'issues: none'. … 'build_select' is requesting 'issues: read, pull-requests: read', but is only allowed 'issues: none, pull-requests: none'.

A caller job's permissions: caps the entire reusable's GITHUB_TOKEN. A reusable's nested jobs cannot request more than the caller grants, and GitHub validates this at startup — before any job, regardless of if: guards, and regardless of the bot App token doing the real writes. groom.yml's jobs declare:

file → issues: write (opens/labels the groom issues)
build_select → issues: read, pull-requests: read (ledger dedup vs issue + PR state)

So every caller must grant the union contents: read + issues: write + pull-requests: read.

The groom.yml header caller-pattern example wrongly stated issues: write was "REQUIRED ONLY if you OMIT bot_app_id" — which is false and sent both groom callers written to date (this repo's ci-groom.yml and the comfy-cloud-mcp-server pilot) into that wall. ci-groom.yml granted contents: read only and could never have run.

Changes

ci-groom.yml — grant the full union (was contents: read only).
groom.yml header — correct the caller-pattern permissions: block and its rationale.
README.md — state the required caller grant on the groom row.

No behavior change to the reusable itself — docs + the self-pilot caller only.

ELI5

The groom robot needs permission to write GitHub issues. The instructions told people it didn't (if using the bot account), so everyone who copied them granted too little and GitHub refused to start the robot. This fixes the instructions and the one caller in this repo.

🤖 Generated with Claude Code

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/Comfy-Org/github-workflows/pull/64 **Author:** [@mattmillerai](https://github.com/mattmillerai) **Created:** 7/23/2026 **Status:** ✅ Merged **Merged:** 7/23/2026 **Merged by:** [@mattmillerai](https://github.com/mattmillerai) **Base:** `main` ← **Head:** `matt/be-3873-groom-caller-permissions-doc` --- ### 📝 Commits (2) - [`34aa7dd`](https://github.com/Comfy-Org/github-workflows/commit/34aa7ddcdc4d9683269113c95dac07d71cb5d960) fix(groom): correct required caller permissions in ci-groom, header, README (BE-3873) - [`8ac0241`](https://github.com/Comfy-Org/github-workflows/commit/8ac02411e2dcbff7c306c5c9b60accd76542c77b) fix(groom): grant id-token:write for claude-code-action OIDC in agent jobs + callers (BE-3873) ### 📊 Changes **3 files changed** (+33 additions, -9 deletions) <details> <summary>View changed files</summary> 📝 `.github/workflows/ci-groom.yml` (+11 -3) 📝 `.github/workflows/groom.yml` (+21 -5) 📝 `README.md` (+1 -1) </details> ### 📄 Description ## What Fixes the groom **caller permissions** documentation + the self-pilot caller so groom callers can actually start. ## Why A groom dry-run dispatch startup-failed (0 jobs) with: > The nested job 'file' is requesting 'issues: write', but is only allowed 'issues: none'. … 'build_select' is requesting 'issues: read, pull-requests: read', but is only allowed 'issues: none, pull-requests: none'. A caller job's `permissions:` caps the entire reusable's `GITHUB_TOKEN`. A reusable's nested jobs cannot request more than the caller grants, and GitHub validates this **at startup** — before any job, regardless of `if:` guards, and regardless of the bot App token doing the real writes. groom.yml's jobs declare: 1. `file` → `issues: write` (opens/labels the `groom` issues) 2. `build_select` → `issues: read`, `pull-requests: read` (ledger dedup vs issue + PR state) So every caller must grant the union `contents: read` + `issues: write` + `pull-requests: read`. The `groom.yml` header caller-pattern example wrongly stated `issues: write` was "REQUIRED ONLY if you OMIT bot_app_id" — which is false and sent **both** groom callers written to date (this repo's `ci-groom.yml` and the comfy-cloud-mcp-server pilot) into that wall. `ci-groom.yml` granted `contents: read` only and could never have run. ## Changes 1. **`ci-groom.yml`** — grant the full union (was `contents: read` only). 2. **`groom.yml` header** — correct the caller-pattern `permissions:` block and its rationale. 3. **`README.md`** — state the required caller grant on the groom row. No behavior change to the reusable itself — docs + the self-pilot caller only. ## ELI5 The groom robot needs permission to write GitHub issues. The instructions told people it didn't (if using the bot account), so everyone who copied them granted too little and GitHub refused to start the robot. This fixes the instructions and the one caller in this repo. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-26 22:35:56 +00:00