From 1a7d8e0d714610fb814db58da986e4abfbb01b7d Mon Sep 17 00:00:00 2001 From: Josh Price Date: Sun, 2 Aug 2026 09:58:26 +1000 Subject: [PATCH 1/2] fix(ci): give the credo job contents: read so it can check out private repos --- .github/workflows/ash-ci.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/ash-ci.yml b/.github/workflows/ash-ci.yml index a61c7a5fa..4951797f6 100644 --- a/.github/workflows/ash-ci.yml +++ b/.github/workflows/ash-ci.yml @@ -536,6 +536,10 @@ jobs: runs-on: ubuntu-latest needs: build-test permissions: + # actions/checkout needs this. A job-level `permissions:` block replaces the + # workflow default rather than adding to it, so omitting `contents` leaves + # the job with none — which fails checkout on a private repository. + contents: read security-events: write steps: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 From a6c86abe15a459498c4a3ea0bfb71d0fc7d8aaa3 Mon Sep 17 00:00:00 2001 From: Josh Price Date: Sun, 2 Aug 2026 10:04:57 +1000 Subject: [PATCH 2/2] fix(ci): add contents: read to the credo job --- .github/workflows/ash-ci.yml | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/.github/workflows/ash-ci.yml b/.github/workflows/ash-ci.yml index 4951797f6..0fc8e2686 100644 --- a/.github/workflows/ash-ci.yml +++ b/.github/workflows/ash-ci.yml @@ -536,9 +536,7 @@ jobs: runs-on: ubuntu-latest needs: build-test permissions: - # actions/checkout needs this. A job-level `permissions:` block replaces the - # workflow default rather than adding to it, so omitting `contents` leaves - # the job with none — which fails checkout on a private repository. + # A job-level block replaces the workflow default; checkout needs this. contents: read security-events: write steps: