Summary

Two unrelated CI workflows have been failing on main and are fixed here together.

• Packaging Check (packaging.yaml) — failed after PR refactor(server): merge pkg/api into pkg/server, drop legacy direct handlers #1127 because the dry-run step did not set HOMEBREW_DEPLOY_KEY, so the brews template references to .Env.HOMEBREW_DEPLOY_KEY in .goreleaser.yaml blew up with template: failed to apply "{{ .Env.HOMEBREW_DEPLOY_KEY }}": map has no entry for key "HOMEBREW_DEPLOY_KEY". Fixed by injecting an empty placeholder; publish is skipped so the value is never consumed. The real secret is still provided by the release workflow in on-tag.yaml.
• OK to Test (ok-to-test.yaml) — has been failing with startup_failure on every issue_comment trigger since PRs refactor(ci): make /ok-to-test's unprivileged status explicit via privileged_ci input #1064 / fix(ci): drop privileged grants from /ok-to-test fork path #1067. Root cause: GitHub validates the union of permissions declared by every job in the called workflow at workflow startup, before if: conditions evaluate. qualification.yaml's cli-e2e declares id-token: write and security-scan declares security-events: write, but the caller granted neither. Even though both jobs are gated by if: inputs.privileged_ci=false, the run never gets that far. Fixed by declaring those permissions on the reusable-workflow call; the gated jobs are still skipped on the fork path, so no fork-controlled code ever executes with elevated tokens.

Motivation/Context

The Packaging Check failure was visible in https://github.com/NVIDIA/aicr/actions/runs/26692166497 right after PR #1127 merged (any push to main touching .goreleaser.yaml triggers it). The OK to Test failure is older — 100+ consecutive startup_failure runs going back to 2026-05-28 (see https://github.com/NVIDIA/aicr/actions/runs/26691845494). Both are pre-existing latent issues exposed by recent changes; this PR clears them.

Type of Change

• Bug fix (CI workflows)

Components Affected

• CI (.github/workflows/packaging.yaml, .github/workflows/ok-to-test.yaml)

Implementation Notes

• The ok-to-test.yaml change documents in-line why "deliberately withheld" permissions (per PR fix(ci): drop privileged grants from /ok-to-test fork path #1067) cannot actually be withheld at the workflow-call level once the reusable workflow declares them on any job. Security intent is preserved by the if: inputs.privileged_ci runtime gating, which keeps fork-controlled code from running with the declared tokens.
• The packaging.yaml change keeps the fix minimal and CI-local rather than complicating the goreleaser template for production releases.

Testing

• actionlint and yamllint clean on both modified files.
• Verified locally that HOMEBREW_DEPLOY_KEY="" lets goreleaser release --snapshot --clean --skip=publish,sbom get past template evaluation and write the brew formula (final local-only failures were unrelated gcloud/docker sandbox issues, not present in CI).
• Post-merge, the next push to main that touches .goreleaser.yaml should keep Packaging Check green, and the next /ok-to-test comment on any PR should authorize and dispatch the qualification suite.

Risk Assessment

Low. CI-only configuration changes. No application code or release artifacts affected.

Checklist

• Changes pass actionlint and yamllint
• No application code changes
• Commit is GPG-signed (-S)