feat: update permissions for pull requests and issues in workflow files - #106
Merged
Conversation
github-actions
Bot
requested review from
a team and
ChristophShyper
as code owners
May 24, 2026 18:09
ChristophShyper
approved these changes
May 24, 2026
There was a problem hiding this comment.
Pull request overview
This PR updates GitHub Actions workflows (and workflow templates) to support centralized end-to-end validation via devops-infra/triglav, while also expanding GITHUB_TOKEN permissions (notably for Pull Requests and Issues) to enable those flows.
Changes:
- Expanded
permissions:across repo workflows and all shipped workflow templates (addsissues: write, upgrades somepull-requests/contentsscopes towrite). - Added Triglav-based E2E orchestration jobs to reusable workflows (PR, release-branch prepare, release create).
- Added a release-tag ref verification job to ensure
vX.Y.Z,vX.Y, andvXtags resolve to the same target.
Reviewed changes
Copilot reviewed 20 out of 20 changed files in this pull request and generated 18 comments.
Show a summary per file
| File | Description |
|---|---|
| .github/workflows/auto-pull-request-create.yml | Updates caller workflow token permissions (now broader) for PR automation. |
| .github/workflows/auto-release-create.yml | Updates caller workflow token permissions (now broader) for release automation. |
| .github/workflows/manual-release-branch-prepare.yml | Updates caller workflow token permissions (now broader) for manual release-branch preparation. |
| .github/workflows/reusable-auto-pull-request-create.yml | Adds Triglav E2E jobs + adjusts permissions and docker job outputs for PR validation. |
| .github/workflows/reusable-auto-release-create.yml | Adds release tag ref verification + Triglav E2E jobs; broadens workflow permissions. |
| .github/workflows/reusable-manual-release-branch-prepare.yml | Adds Triglav E2E jobs; broadens workflow permissions. |
| README.md | Documents the centralized action development / validation flow via Triglav. |
| profile/README.md | Adds Triglav to the org/tooling validation framework list. |
| templates/actions/workflows/auto-pull-request-create.yml | Updates template workflow permissions (now broader). |
| templates/actions/workflows/auto-release-create.yml | Updates template workflow permissions (now broader). |
| templates/actions/workflows/manual-release-branch-prepare.yml | Updates template workflow permissions (now broader). |
| templates/dockerized/workflows/auto-pull-request-create.yml | Updates template workflow permissions (now broader). |
| templates/dockerized/workflows/auto-release-create.yml | Updates template workflow permissions (now broader). |
| templates/dockerized/workflows/manual-release-branch-prepare.yml | Updates template workflow permissions (now broader). |
| templates/other/workflows/auto-pull-request-create.yml | Updates template workflow permissions (now broader). |
| templates/other/workflows/auto-release-create.yml | Updates template workflow permissions (now broader). |
| templates/other/workflows/manual-release-branch-prepare.yml | Updates template workflow permissions (now broader). |
| templates/static/workflows/auto-pull-request-create.yml | Updates template workflow permissions (now broader). |
| templates/static/workflows/auto-release-create.yml | Updates template workflow permissions (now broader). |
| templates/static/workflows/manual-release-branch-prepare.yml | Updates template workflow permissions (now broader). |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
30
to
+34
| permissions: | ||
| contents: read | ||
| contents: write | ||
| packages: write | ||
| pull-requests: write | ||
| issues: write |
Comment on lines
32
to
+36
| permissions: | ||
| contents: write | ||
| packages: write | ||
| pull-requests: read | ||
| pull-requests: write | ||
| issues: write |
Comment on lines
43
to
+47
| permissions: | ||
| contents: write | ||
| packages: write | ||
| pull-requests: write | ||
| issues: write |
Comment on lines
21
to
+25
| permissions: | ||
| contents: write | ||
| packages: write | ||
| pull-requests: read | ||
| pull-requests: write | ||
| issues: write |
Comment on lines
11
to
+15
| permissions: | ||
| contents: read | ||
| contents: write | ||
| packages: write | ||
| pull-requests: write | ||
| issues: write |
Comment on lines
21
to
+25
| permissions: | ||
| contents: write | ||
| packages: write | ||
| pull-requests: read | ||
| pull-requests: write | ||
| issues: write |
Comment on lines
27
to
+30
| contents: write | ||
| packages: write | ||
| pull-requests: write | ||
| issues: write |
Comment on lines
11
to
+15
| permissions: | ||
| contents: read | ||
| contents: write | ||
| packages: write | ||
| pull-requests: write | ||
| issues: write |
Comment on lines
21
to
+25
| permissions: | ||
| contents: write | ||
| packages: write | ||
| pull-requests: read | ||
| pull-requests: write | ||
| issues: write |
Comment on lines
26
to
+30
| permissions: | ||
| contents: write | ||
| packages: write | ||
| pull-requests: write | ||
| issues: write |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
📝 Brief description
feat: add Triglav as end-to-end test orchestrator
feat: update permissions for pull requests and issues in workflow files
💻 Commits
| feat: update permissions for pull requests and issues in workflow files
|
feat: add Triglav as end-to-end test orchestrator
📁 Modified files
.github/workflows/auto-pull-request-create.yml | 3 +-
.github/workflows/auto-release-create.yml | 3 +-
.../workflows/manual-release-branch-prepare.yml | 1 +
.../reusable-auto-pull-request-create.yml | 99 ++++++++++-
.github/workflows/reusable-auto-release-create.yml | 187 ++++++++++++++++++++-
.../reusable-manual-release-branch-prepare.yml | 91 ++++++++++
README.md | 10 ++
profile/README.md | 4 +
.../actions/workflows/auto-pull-request-create.yml | 3 +-
.../actions/workflows/auto-release-create.yml | 3 +-
.../workflows/manual-release-branch-prepare.yml | 1 +
.../workflows/auto-pull-request-create.yml | 3 +-
.../dockerized/workflows/auto-release-create.yml | 3 +-
.../workflows/manual-release-branch-prepare.yml | 1 +
.../other/workflows/auto-pull-request-create.yml | 3 +-
templates/other/workflows/auto-release-create.yml | 3 +-
.../workflows/manual-release-branch-prepare.yml | 1 +
.../static/workflows/auto-pull-request-create.yml | 3 +-
templates/static/workflows/auto-release-create.yml | 3 +-
.../workflows/manual-release-branch-prepare.yml | 1 +
20 files changed, 414 insertions(+), 12 deletions(-)
Check CONTRIBUTING.md and CODE_OF_CONDUCT.md for more information