From ca858c88eaf7e6afa5a90a155ec01dd0f64ad9dc Mon Sep 17 00:00:00 2001 From: reesebuilt <126643625+reesepj@users.noreply.github.com> Date: Wed, 5 Aug 2026 02:40:16 -0500 Subject: [PATCH] Grant the provenance job contents: write so the workflow can start The SLSA generator declares an upload-assets job requiring contents: write. GitHub validates a called workflow's declared permissions when the run is created, before any if: guard is evaluated, so granting contents: read made the entire workflow fail with startup_failure and no job ever ran. upload-assets is false, so that job still never executes and the release job remains the only thing that attaches assets. The previous comment reasoned correctly about runtime and drew the wrong conclusion about startup. Signed-off-by: reesebuilt <126643625+reesepj@users.noreply.github.com> --- .github/workflows/release.yml | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index e4132ff..c18490a 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -266,10 +266,13 @@ jobs: actions: read # Sign the provenance against the workflow's own OIDC identity. id-token: write - # Read only. Inside the generator, contents: write belongs to its upload-assets job, which - # is guarded by `if: inputs.upload-assets` and therefore never runs here: the release job - # below attaches the provenance, so one job stays in charge of what the release contains. - contents: read + # contents: write is required to START, not to run. GitHub validates a called workflow's + # DECLARED permissions statically, and the generator declares an upload-assets job needing + # contents: write. That job is guarded by `if: inputs.upload-assets`, which is false here, + # so it never executes, but granting less makes the whole workflow fail to instantiate with + # no job ever running. Reasoning about runtime behaviour does not satisfy a static check. + # The release job below is still the only thing that attaches assets. + contents: write uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.1.0 with: base64-subjects: ${{ needs.build.outputs.hashes }}