[nordz0r]

Summary

• Caller pull-request.yml only had contents: read, while nested job release in build.yml declares contents: write.
• GitHub validates the union of nested permissions at graph-resolve time even when publish: false skips release, so every pull-request run since ~2026-09-02 failed with startup_failure / 0 jobs.
• Grant contents: write on the reusable call (keep packages/id-token/attestations write + secrets: inherit).

Test plan

• pull-request workflow on this PR starts jobs (not startup_failure)
• After merge, re-run checks on dependabot PR chore(deps): Bump the actions group with 2 updates #6 (do not merge chore(deps): Bump the actions group with 2 updates #6 here)

[coldtea-pr-lens]

◈ PR Lens

Note

Nothing here is code, only docs, data or images, so PR Lens left this pull request undrawn. Comment @pr-lens draw to draw it

_{github.comment.notice: false in .github/pr-lens.yml turns this note off}

[nordz0r]

wait — diff OK; CI started (startup_failure fixed)

One-file change in .github/workflows/pull-request.yml: caller contents: read → write on the reusable build.yml call. That matches GitHub’s graph-resolve rule: the caller must grant the union of nested job permissions, including release’s contents: write, even when publish: false skips that job.

Evidence on HEAD 7bc7fcab:

• pull-request run 35898119890 is in_progress with real jobs (Checkout / version check / Buildx / Build amd64) — not the previous 0-job startup_failure.
• GitGuardian: success.
• Login / push / attestation steps correctly skipped under publish: false.

Not merging until Build & smoke finishes green. After merge: re-run checks on dependabot #6 (do not merge #6 here).

[nordz0r]

approve-ready (COMMENT; APPROVE blocked on own PR) — contents:write on caller fixes startup_failure; CI green on HEAD 7bc7fca (run 35898119890). Nested Build & smoke ran; GitHub Release correctly skipped under publish:false. Squash-merging.

[nordz0r]

approve — CI green (Build&smoke SUCCESS, release SKIPPED). Caller contents:write fixes startup_failure. Squash-merge.