sadpandajoe opened a new pull request, #45899: URL: https://github.com/apache/superset/pull/45899
### SUMMARY Six Python CI jobs declare a job-level `permissions:` block containing only `id-token: write` (needed for the Codecov OIDC upload). A job-level `permissions:` block replaces the workflow-level default instead of extending it, so these jobs silently lose the `contents: read` that the rest of the workflow runs with. On a public repository that goes unnoticed, because reads of public content are allowed without a token scope. Wherever the repository is not public (private mirrors, private forks), the jobs fail during **Set up job** when the runner downloads the repository's own `setup-backend` composite action at the job's commit, with: ``` An action could not be found at the URI 'https://codeload.github.com/<owner>/<repo>/tar.gz/<sha>' ``` The job log shows `GITHUB_TOKEN Permissions: Metadata: read` only. Because the failure happens before any step runs, the test steps never execute. This adds `contents: read` next to `id-token: write` in each of the six job blocks: - `superset-python-unittest.yml`: `unit-tests` - `superset-python-integrationtest.yml`: `test-mysql`, `test-postgres`, `test-sqlite` - `superset-python-presto-hive.yml`: `test-postgres-presto`, `test-postgres-hive` `id-token: write` is kept, so the Codecov upload is unchanged. On the public repository the effective permissions do not change in any way that matters (`contents: read` is what the workflow already defaults to), so this is a no-op there and makes the jobs work on forks and private mirrors. This is the same class of fix as #45035, which granted the read permissions a public repository allows implicitly to other jobs. ### BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF N/A (CI configuration only). ### TESTING INSTRUCTIONS - `pre-commit run` on the changed files passes (includes the workflow linters). - Scripted check: every job that sets job-level `permissions` with `id-token` also sets `contents`. Before this change six jobs fail that check; after, none do. - The private-repository failure mode can only be observed on a non-public repository. On one, the six jobs now get past **Set up job** and reach their test steps. On this repository, CI should be unchanged. ### ADDITIONAL INFORMATION - [ ] Has associated issue: - [ ] Required feature flags: - [ ] Changes UI - [ ] Includes DB Migration (follow approval process in [SIP-59](https://github.com/apache/superset/issues/13351)) - [ ] Migration is atomic, supports rollback & is backwards-compatible - [ ] Confirm DB migration upgrade and downgrade tested - [ ] Runtime estimates and downtime expectations provided - [ ] Introduces new feature or API - [ ] Removes existing feature or API 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
