You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by po...@apache.org on 2026/04/13 18:57:49 UTC

(airflow) branch main updated: Grant write permissions to scheduled CI upgrade check workflows (#65168)

This is an automated email from the ASF dual-hosted git repository.

potiuk pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/airflow.git


The following commit(s) were added to refs/heads/main by this push:
     new 8291f3774fe Grant write permissions to scheduled CI upgrade check workflows (#65168)
8291f3774fe is described below

commit 8291f3774fec5a01512dcdd9c820bddbcf13dea8
Author: Jarek Potiuk <ja...@potiuk.com>
AuthorDate: Mon Apr 13 20:57:42 2026 +0200

    Grant write permissions to scheduled CI upgrade check workflows (#65168)
    
    The scheduled upgrade check wrappers declared `contents: read`, which
    caps the permissions of the reusable `upgrade-check.yml` they call.
    That workflow needs `contents: write` and `pull-requests: write` to
    push the upgrade branch and open a draft PR, so every scheduled run
    failed immediately with startup_failure:
    
      The workflow is requesting 'contents: write, pull-requests: write',
      but is only allowed 'contents: read, pull-requests: none'.
    
    Raise the caller permissions to the ceiling required by the callee so
    the scheduled upgrade PR job can actually run.
---
 .github/workflows/scheduled-upgrade-check-main.yml      | 3 ++-
 .github/workflows/scheduled-upgrade-check-v3-2-test.yml | 3 ++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/scheduled-upgrade-check-main.yml b/.github/workflows/scheduled-upgrade-check-main.yml
index 5978721b971..1c828f86b03 100644
--- a/.github/workflows/scheduled-upgrade-check-main.yml
+++ b/.github/workflows/scheduled-upgrade-check-main.yml
@@ -23,7 +23,8 @@ on:  # yamllint disable-line rule:truthy
     - cron: '0 6 * * 1,3,5'
   workflow_dispatch:
 permissions:
-  contents: read
+  contents: write
+  pull-requests: write
 jobs:
   upgrade-main:
     name: "[main] Upgrade"
diff --git a/.github/workflows/scheduled-upgrade-check-v3-2-test.yml b/.github/workflows/scheduled-upgrade-check-v3-2-test.yml
index 268dd798f2e..7c924f3e8f3 100644
--- a/.github/workflows/scheduled-upgrade-check-v3-2-test.yml
+++ b/.github/workflows/scheduled-upgrade-check-v3-2-test.yml
@@ -23,7 +23,8 @@ on:  # yamllint disable-line rule:truthy
     - cron: '0 6 * * 2,4'
   workflow_dispatch:
 permissions:
-  contents: read
+  contents: write
+  pull-requests: write
 jobs:
   upgrade-v3-2-test:
     name: "[v3-2-test] Upgrade"