yangxk1 commented on PR #933: URL: https://github.com/apache/incubator-graphar/pull/933#issuecomment-4832851619
Verified the ref pin via CI (run 28371852200). The action resolves correctly and reaches the OIDC exchange step, but fails as expected for a fork-sourced PR: > GitHub doesn't give these workflows OIDC permissions, even if `id-token: write` is explicitly configured. This is GitHub's security restriction for fork PRs, not a workflow issue. Real upload verification needs the workflow to run from `push` to `main` or `workflow_dispatch` (which @SemyonSinchenko's #934 will exercise once merged). Closing this one in favor of #934 as discussed. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
