From 5ee027a1445e2e1083473646d362dc32db0af51f Mon Sep 17 00:00:00 2001 From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com> Date: Thu, 27 Aug 2026 10:25:32 -0400 Subject: [PATCH] ci: bump the pr-issue-linkage pin to the four-section contract The caller pinned melodic-software/ci-workflows' pr-issue-linkage reusable at c136b27f (v0.9.1), the oldest pin of the nine callers in the organization. That ref enforces only a closing keyword and a non-empty "## Related" section, so the "## Summary", "## Fix", and "## Verification" headings the inherited org pull request template asks for were never gated here. Move the pin to 7107b348 (v0.14.2), the ref six sibling repositories already run and the ref standards' runner-policy records a contract for. The reusable's workflow file is byte-identical from v0.14.2 through ci-workflows' main. The runner input is unchanged and still accepted at this ref. The job must now grant actions: read alongside pull-requests: read. The reusable at this ref declares both where v0.9.1 declared neither, a reusable cannot elevate caller permissions, and GitHub rejects it at startup when the caller grants a stricter set, so the required context would never materialize rather than report red. Standards' runner-policy records the same pair as this ref's minimumCallerPermissions. Co-Authored-By: Claude Fable 5 --- .github/workflows/pr-issue-linkage.yml | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/.github/workflows/pr-issue-linkage.yml b/.github/workflows/pr-issue-linkage.yml index cfb9b6d..caffcb2 100644 --- a/.github/workflows/pr-issue-linkage.yml +++ b/.github/workflows/pr-issue-linkage.yml @@ -18,8 +18,17 @@ concurrency: jobs: pr-issue-linkage: + # Job-level permissions replace the workflow-level block outright, so both + # scopes the reusable declares are listed here: pull-requests: read to read + # the PR body it validates, and actions: read for its + # cancelled-versus-timed_out prerequisite resolver. A reusable cannot + # elevate caller permissions, and GitHub rejects it at startup when the + # caller grants a stricter set — the required context then never + # materializes at all, rather than reporting red. Standards' runner-policy + # records the same pair as this ref's `minimumCallerPermissions`. permissions: pull-requests: read - uses: melodic-software/ci-workflows/.github/workflows/pr-issue-linkage.yml@c136b27f404dd32ce3873f39a6f3443891d1c16e # c136b27 2026-07-27 v0.9.1 + actions: read + uses: melodic-software/ci-workflows/.github/workflows/pr-issue-linkage.yml@7107b34832a7b6db5d08d3b132621c599fbe5e50 # 7107b34 2026-08-13 v0.14.2 with: runner: ubuntu-24.04