Skip to content

fix GITHUB_TOKEN permissions in workflows#11392

Merged
SoftFever merged 5 commits into
OrcaSlicer:mainfrom
NanashiTheNameless:fix-workflows
Nov 18, 2025
Merged

fix GITHUB_TOKEN permissions in workflows#11392
SoftFever merged 5 commits into
OrcaSlicer:mainfrom
NanashiTheNameless:fix-workflows

Conversation

@NanashiTheNameless

@NanashiTheNameless NanashiTheNameless commented Nov 17, 2025 •
edited
Loading

Copy link
Copy Markdown
Contributor

This pull request updates GitHub Actions workflow files to explicitly set permissions for certain actions. (fixing the permissions issues)

Workflow permissions updates:

  • Added explicit issues: write permission to the assign.yml workflow to ensure it can modify issues as needed.
  • Set contents: write, actions: write, and checks: write permissions in the build_all.yml workflow to allow the workflow to interact with repository contents, manage actions, and update checks.

@NanashiTheNameless

NanashiTheNameless commented Nov 17, 2025 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

theoretically this should fix some of the issues with WebFreak001/deploy-nightly failing, still double-checking though done confirming, does not break workflow

@NanashiTheNameless NanashiTheNameless marked this pull request as ready for review November 17, 2025 22:36
@NanashiTheNameless

NanashiTheNameless commented Nov 17, 2025

Copy link
Copy Markdown
Contributor Author

contents: write is needed to modify tags (nightly release tag)
actions: write is needed by actions/cache to update/modify build cache
checks: write is needed for the unit tests

@NanashiTheNameless

NanashiTheNameless commented Nov 18, 2025 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

/assign-me

(I guess this doesn't work)

@NanashiTheNameless

NanashiTheNameless commented Nov 18, 2025

Copy link
Copy Markdown
Contributor Author

@Noisyfox Could I get you to take a peek at this?

@NanashiTheNameless NanashiTheNameless changed the title Add permissions section to build workflow fix GITHUB_TOKEN permissions in workflows Nov 18, 2025
@SoftFever SoftFever requested a review from Copilot November 18, 2025 07:41
Copilot AI reviewed Nov 18, 2025
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

This PR updates GitHub Actions workflow permissions to fix permission issues by adding explicit permission declarations at the workflow level.

  • Added issues: write permission to the assign.yml workflow for issue management
  • Added contents: write, actions: write, and checks: write permissions to the build_all.yml workflow for build and deployment operations

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File Description
.github/workflows/assign.yml Added workflow-level issues: write permission to complement existing job-level permission for the issue assignment action
.github/workflows/build_all.yml Added workflow-level permissions (contents: write, actions: write, checks: write) to enable release deployment and test result publishing

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread .github/workflows/build_all.yml Outdated
@SoftFever

SoftFever commented Nov 18, 2025

Copy link
Copy Markdown
Collaborator

@NanashiTheNameless
Thank you for looking into this issue.
Do you know why this started happening only after the repo was moved? It was working with the exact same code before.

@NanashiTheNameless

NanashiTheNameless commented Nov 18, 2025

Copy link
Copy Markdown
Contributor Author

@NanashiTheNameless Thank you for looking into this issue. Do you know why this started happening only after the repo was moved? It was working with the exact same code before.

My understanding is it has to do with the API and weirdness relating to GITHUB_TOKEN and organizations my assumption is the defaults are different for users and organizations

@NanashiTheNameless

NanashiTheNameless commented Nov 18, 2025

Copy link
Copy Markdown
Contributor Author

@SoftFever please see Workflow permissions at the bottom of https://github.com/OrcaSlicer/OrcaSlicer/settings/actions

@NanashiTheNameless

NanashiTheNameless commented Nov 18, 2025

Copy link
Copy Markdown
Contributor Author

by designating the permissions used we can ensure the token used by https://github.com/NanashiTheNameless/OrcaSlicer/blob/fix-workflows/.github/workflows/build_check_cache.yml#L44 and every instance of WebFreak001/[email protected] have the permissions they need to run correctly.

@NanashiTheNameless

NanashiTheNameless commented Nov 18, 2025

Copy link
Copy Markdown
Contributor Author

@SoftFever also why was https://github.com/NanashiTheNameless/OrcaSlicer/blob/fix-workflows/.github/actions/apt-install-deps/action.yml sectioned off?

@SoftFever

SoftFever commented Nov 18, 2025 •
edited
Loading

Copy link
Copy Markdown
Collaborator

@SoftFever please see Workflow permissions at the bottom of https://github.com/OrcaSlicer/OrcaSlicer/settings/actions

Noisyfox also suspects this is the cause. It's grayed out for me as well. Let me take a closer look.

@NanashiTheNameless

NanashiTheNameless commented Nov 18, 2025

Copy link
Copy Markdown
Contributor Author

@SoftFever please see Workflow permissions at the bottom of https://github.com/OrcaSlicer/OrcaSlicer/settings/actions

Noisyfox also suspects this is the cause. It's grayed out for me as well. Let me take a closer look.

I think the migration did more than intended, adding the the permissions flag is worth adding regardless IMO

@SoftFever

SoftFever commented Nov 18, 2025

Copy link
Copy Markdown
Collaborator

@SoftFever please see Workflow permissions at the bottom of https://github.com/OrcaSlicer/OrcaSlicer/settings/actions

Noisyfox also suspects this is the cause. It's grayed out for me as well. Let me take a closer look.

I think the migration did more than intended, adding the the permissions flag is worth adding regardless IMO

Agreed, let me try adjusting the settings first to figure out the root cause, and then we can merge this pull request.

@NanashiTheNameless

NanashiTheNameless commented Nov 18, 2025

Copy link
Copy Markdown
Contributor Author

@SoftFever please see Workflow permissions at the bottom of https://github.com/OrcaSlicer/OrcaSlicer/settings/actions

Noisyfox also suspects this is the cause. It's grayed out for me as well. Let me take a closer look.

I think the migration did more than intended, adding the the permissions flag is worth adding regardless IMO

Agreed, let me try adjusting the settings first to figure out the root cause, and then we can merge this pull request.

sounds good

SoftFever
SoftFever approved these changes Nov 18, 2025
View reviewed changes

@SoftFever SoftFever left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM
Thank you!

@SoftFever SoftFever merged commit aa5350a into OrcaSlicer:main Nov 18, 2025
@SoftFever

SoftFever commented Nov 18, 2025

Copy link
Copy Markdown
Collaborator

@NanashiTheNameless
Looks like there are some errors: https://github.com/OrcaSlicer/OrcaSlicer/actions/runs/19471348206
We’re requesting write access where it’s not required.

NanashiTheNameless added a commit to NanashiTheNameless/OrcaSlicer that referenced this pull request Nov 18, 2025
@NanashiTheNameless
correct oversight in OrcaSlicer#11392
29866ea 
OrcaSlicer#11392 (comment)
@NanashiTheNameless NanashiTheNameless mentioned this pull request Nov 18, 2025
Merged
@NanashiTheNameless NanashiTheNameless deleted the fix-workflows branch November 18, 2025 15:35
NanashiTheNameless added a commit to NanashiTheNameless/OrcaSlicer that referenced this pull request Nov 18, 2025
@NanashiTheNameless
correct oversight in OrcaSlicer#11392
40de5b0
Noisyfox pushed a commit that referenced this pull request Nov 21, 2025
@NanashiTheNameless
correct oversight in #11392 (#11404)
fb3b2aa 
* correct oversight in #11392

#11392 (comment)

* correct oversight in #11392
@NanashiTheNameless NanashiTheNameless mentioned this pull request Nov 21, 2025
Merged
SoftFever added a commit that referenced this pull request Nov 21, 2025
@SoftFever
Revert "correct oversight in #11392 (#11404)"
91577f3 
This reverts commit fb3b2aa.
SoftFever added a commit that referenced this pull request Nov 21, 2025
@SoftFever
Revert "fix GITHUB_TOKEN permissions in workflows (#11392)"
3a7309a 
This reverts commit aa5350a.
Revert "correct oversight in #11392 (#11404)"

This reverts commit fb3b2aa.
dbaarda pushed a commit to dbaarda/OrcaSlicer that referenced this pull request Nov 27, 2025
Merge branch 'main' into upd-eigen-5.0.0
b68556d 
* main: (272 commits)
  Delete validate-documentation.yml (OrcaSlicer#11477)
  Update printer profiles for Artillery (OrcaSlicer#11284)
  Fix emulated spiral Z-hop XY offset on multi-plate slicing (OrcaSlicer#11468)
  Move WIKI to new repo
  Validate invalid fields for hidden system profiles (OrcaSlicer#11455)
  ci: Increase timeout for dedupe-issues workflow from 10 to 30 minutes
  Fix CICD AI dedupe
  Change runner from self-hosted to ubuntu-latest
  Check duplicated issues. ported from Claude code repo (OrcaSlicer#11454)
  UI fixes / improvements (OrcaSlicer#11413)
  Fix Spiral Z-Hop arc handling (OrcaSlicer#11430)
  FIX: Open provided file at startup (OrcaSlicer#11419)
  Re-include BBS's Clipperutils2 (OrcaSlicer#11415)
  Fix filament profile import if inherit from vendor generic (OrcaSlicer#11398)
  Fix crash after syncing printer (OrcaSlicer#11428)
  Wiki 16 (MiniUpdate): Updated by Stable cmake 4.2 release + VS2026 First (OrcaSlicer#11423)
  Revert "fix GITHUB_TOKEN permissions in workflows (OrcaSlicer#11392)"
  correct oversight in OrcaSlicer#11392 (OrcaSlicer#11404)
  Profiles for Creality K2 Pro printer (OrcaSlicer#11315)
  Reduce artifacts from short travel moves before external perimeters (OrcaSlicer#10722)
  ...
dbaarda pushed a commit to dbaarda/OrcaSlicer that referenced this pull request Dec 1, 2025
Merge branch 'upd-eigen-5.0.0' into tst-eigennesting
012f931 
* upd-eigen-5.0.0: (273 commits)
  Delete validate-documentation.yml (OrcaSlicer#11477)
  Update printer profiles for Artillery (OrcaSlicer#11284)
  Fix emulated spiral Z-hop XY offset on multi-plate slicing (OrcaSlicer#11468)
  Move WIKI to new repo
  Validate invalid fields for hidden system profiles (OrcaSlicer#11455)
  ci: Increase timeout for dedupe-issues workflow from 10 to 30 minutes
  Fix CICD AI dedupe
  Change runner from self-hosted to ubuntu-latest
  Check duplicated issues. ported from Claude code repo (OrcaSlicer#11454)
  UI fixes / improvements (OrcaSlicer#11413)
  Fix Spiral Z-Hop arc handling (OrcaSlicer#11430)
  FIX: Open provided file at startup (OrcaSlicer#11419)
  Re-include BBS's Clipperutils2 (OrcaSlicer#11415)
  Fix filament profile import if inherit from vendor generic (OrcaSlicer#11398)
  Fix crash after syncing printer (OrcaSlicer#11428)
  Wiki 16 (MiniUpdate): Updated by Stable cmake 4.2 release + VS2026 First (OrcaSlicer#11423)
  Revert "fix GITHUB_TOKEN permissions in workflows (OrcaSlicer#11392)"
  correct oversight in OrcaSlicer#11392 (OrcaSlicer#11404)
  Profiles for Creality K2 Pro printer (OrcaSlicer#11315)
  Reduce artifacts from short travel moves before external perimeters (OrcaSlicer#10722)
  ...
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments

@SoftFever SoftFever SoftFever approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@NanashiTheNameless @SoftFever