EnxDev commented on code in PR #42472:
URL: https://github.com/apache/superset/pull/42472#discussion_r3656988908
##########
.github/workflows/superset-frontend.yml:
##########
@@ -23,6 +23,12 @@ jobs:
frontend-build:
runs-on: ubuntu-26.04
timeout-minutes: 30
+ # The change detector reads the PR's file list, which needs
+ # `pull-requests: read`. Public repos serve that endpoint without it;
+ # private forks return 403.
+ permissions:
Review Comment:
I took a look at the other workflows that use
`./.github/actions/change-detector/` (12 in total), and they all already grant
`pull-requests: read` to the job running the detector, either at the top level
or at the job level.
`superset-frontend.yml` seems to be the only one missing it, so this change
would actually bring it in line with the existing workflows rather than
introduce a new inconsistency.
On the public repository, the endpoint is readable without this permission
anyway, but keeping it here ensures consistency with private-fork setups, as
the other workflows already do.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
