Fix publish-docker permissions; harden release-bump no-op detection · quicknode/cli@51bae95 · GitHub

quicknode / cli Public

• Notifications You must be signed in to change notification settings
• Fork 1
• Star 3

• Code
• Issues
• Pull requests 1
• Actions
• Projects
• Security and quality
• Insights

Additional navigation options

Commit 51bae95

Browse filesBrowse the repository at this point in the historyBrowse files

johnpmitsch

committed

Fix publish-docker permissions; harden release-bump no-op detection

The first attempt at v0.1.0 failed at workflow startup because publish-docker.yml declared `contents: read` and `attestations: write` at the workflow level — permissions that the calling job (custom-publish-docker in release.yml, generated by cargo-dist) doesn't grant. GitHub rejects reusable workflows that try to widen permissions beyond what the caller grants. Trim publish-docker.yml's top-level permissions to just `packages: write` and `id-token: write`, matching what cargo-dist gives the custom job. We never call actions/attest in this workflow (the SLSA attestations are already attached upstream by the build-local-artifacts job), so dropping `attestations: write` doesn't cost us anything. `contents: read` is inherited from the caller's workflow-level `contents: write`. Also harden `release-bump`: if Cargo.toml is already at the requested version (true for the first release where the scaffold lands at the intended version), exit cleanly with a hint pointing at release-tag-main, instead of creating an empty branch and a doomed PR. Triggered by the exact path we hit on the first v0.1.0 attempt.

1 parent b54c312 commit 51bae95
Copy full SHA for 51bae95

2 files changed

+10-2Lines changed: 10 additions & 2 deletions

File tree

Expand file treeCollapse file tree

Open diff view settings

Filter options

• .github/workflows
  • publish-docker.yml
• Justfile

Expand file treeCollapse file tree

Open diff view settings

Collapse file

‎.github/workflows/publish-docker.yml‎

Copy file name to clipboardExpand all lines: .github/workflows/publish-docker.yml

+5-2Lines changed: 5 additions & 2 deletions

Original file line number	Diff line number	Diff line change
@@ -16,11 +16,14 @@ on:
16	16	required: true
17	17	type: string
18	18
	19	+ # Permissions must NOT exceed what the caller (release.yml's
	20	+ # `custom-publish-docker` job) grants — reusable workflows can't widen
	21	+ # permissions. cargo-dist gives custom publish jobs id-token + packages
	22	+ # write, plus the workflow-level contents: write inherited via the
	23	+ # caller. That's enough for GHCR push and gh release download.
19	24	permissions:
20		- contents: read
21	25	packages: write
22	26	id-token: write
23		- attestations: write
24	27
25	28	env:
26	29	REGISTRY: ghcr.io

Collapse file

‎Justfile‎

Copy file name to clipboardExpand all lines: Justfile

+5Lines changed: 5 additions & 0 deletions

Original file line number	Diff line number	Diff line change
@@ -67,6 +67,11 @@ release-bump version:
67	67	echo "Error: working tree is not clean. Commit or stash changes before bumping." >&2
68	68	exit 1
69	69	fi
	70	+ current_version=$(sed -nE 's/^version = "(.+)"/\1/p' Cargo.toml | head -1)
	71	+ if [[ "$current_version" == "{{version}}" ]]; then
	72	+ echo "Cargo.toml is already at {{version}}. No bump needed — skip to: just release-tag-main {{version}}" >&2
	73	+ exit 0
	74	+ fi
70	75	git checkout -b "release/v{{version}}"
71	76	sed -i.bak 's/^version = ".*"/version = "{{version}}"/' Cargo.toml && rm Cargo.toml.bak
72	77	# Refresh Cargo.lock so it matches the new version.

0 commit comments

Comments

0 (0)