Fix GitHub Releases deployment. #2444
Conversation
The addition of digital attestations in pex-tool#2442 broke the GitHub Releases release by moving from default permissions to more restrictive explicit permission. Those permissions lacked the content write permission needed to create the release and post its artifacts.
| @@ -72,6 +72,7 @@ jobs: | |||
| permissions: | |||
| id-token: write | |||
| attestations: write | |||
| contents: write | |||
There was a problem hiding this comment.
The failure caused by the lack of content write permission can be seen here: https://github.com/pex-tool/pex/actions/runs/9684301905/job/26722997959
| @@ -72,6 +72,7 @@ jobs: | |||
| permissions: | |||
| id-token: write | |||
| attestations: write | |||
There was a problem hiding this comment.
The attestations did work however: https://github.com/pex-tool/pex/attestations
|
Ok, @benjyw that didn't quite do it. The fix in the 2.6.1 release is a nice-to-have and only really useful if you can't use |
|
Thanks @jsirois, I'll keep an eye out for any urgent release needs. |
|
FWIW, looks like this issue was triggered, presumably by the upgrade of softprops/action-gh-release in #2374, and nothing to do with the attestations. |
|
I don't think so. The action log shows it checked out softprops/action-gh-release@4634c16 which is v2 from February. That issue loosely pattern matches, but is from 2021. I'll be spinning up a test repo to see what's going on. |
The addition of digital attestations in #2442 broke the GitHub Releases
release by moving from default permissions to more restrictive explicit
permission. Those permissions lacked the content write permission needed
to create the release and post its artifacts.