From 05fa1f86f0fbe8a987a644ec519d1dced6aa0414 Mon Sep 17 00:00:00 2001 From: Zahin Mohammad Date: Thu, 23 Jul 2026 17:18:12 +0000 Subject: [PATCH] ci: add actions:read permission for BitGo/build-system resolution The trigger-demo-kms-api-release job uses the private action BitGo/build-system/get-github-token@v6. GitHub Actions requires the actions:read permission to download actions from private repositories in the same organisation; without it, the runner fails during "Set up job" with: Unable to resolve action `bitgo/build-system`, not found The pull_request.yaml workflow already includes this permission with the comment "required by BitGo/build-system". This commit brings release-to-ghcr.yaml into alignment. The two consecutive release failures (2026-07-08 and 2026-07-23) both hit this error after the trigger-demo-kms-api-release job was introduced in commit 10e8df08. Ticket: WCN-1601 Session-Id: 631b2036-5e16-4817-bc5e-f857c5f78c35 Task-Id: ced76a25-0fc3-45b7-b60b-444e751592da --- .github/workflows/release-to-ghcr.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/release-to-ghcr.yaml b/.github/workflows/release-to-ghcr.yaml index ba9123ed..f935007a 100644 --- a/.github/workflows/release-to-ghcr.yaml +++ b/.github/workflows/release-to-ghcr.yaml @@ -9,6 +9,7 @@ concurrency: cancel-in-progress: false permissions: + actions: read # Needed to resolve private BitGo/build-system action contents: write # Needed to create new releases packages: write # Needed to push to GHCR id-token: write # Needed to create an ephemeral cross-repo token