This is an automated email from the ASF dual-hosted git repository.
potiuk pushed a commit to branch v3-2-test
in repository https://gitbox.apache.org/repos/asf/airflow.git
The following commit(s) were added to refs/heads/v3-2-test by this push:
new ea2ae1c2223 [v3-2-test] Grant write permissions to scheduled CI
upgrade check workflows (#65168) (#65176)
ea2ae1c2223 is described below
commit ea2ae1c2223e27426e7045ebc271ce3b99d6135d
Author: github-actions[bot]
<41898282+github-actions[bot]@users.noreply.github.com>
AuthorDate: Mon Apr 13 21:00:22 2026 +0200
[v3-2-test] Grant write permissions to scheduled CI upgrade check workflows
(#65168) (#65176)
The scheduled upgrade check wrappers declared `contents: read`, which
caps the permissions of the reusable `upgrade-check.yml` they call.
That workflow needs `contents: write` and `pull-requests: write` to
push the upgrade branch and open a draft PR, so every scheduled run
failed immediately with startup_failure:
The workflow is requesting 'contents: write, pull-requests: write',
but is only allowed 'contents: read, pull-requests: none'.
Raise the caller permissions to the ceiling required by the callee so
the scheduled upgrade PR job can actually run.
(cherry picked from commit 8291f3774fec5a01512dcdd9c820bddbcf13dea8)
Co-authored-by: Jarek Potiuk <[email protected]>
---
.github/workflows/scheduled-upgrade-check-main.yml | 3 ++-
.github/workflows/scheduled-upgrade-check-v3-2-test.yml | 3 ++-
2 files changed, 4 insertions(+), 2 deletions(-)
diff --git a/.github/workflows/scheduled-upgrade-check-main.yml
b/.github/workflows/scheduled-upgrade-check-main.yml
index 5978721b971..1c828f86b03 100644
--- a/.github/workflows/scheduled-upgrade-check-main.yml
+++ b/.github/workflows/scheduled-upgrade-check-main.yml
@@ -23,7 +23,8 @@ on: # yamllint disable-line rule:truthy
- cron: '0 6 * * 1,3,5'
workflow_dispatch:
permissions:
- contents: read
+ contents: write
+ pull-requests: write
jobs:
upgrade-main:
name: "[main] Upgrade"
diff --git a/.github/workflows/scheduled-upgrade-check-v3-2-test.yml
b/.github/workflows/scheduled-upgrade-check-v3-2-test.yml
index 268dd798f2e..7c924f3e8f3 100644
--- a/.github/workflows/scheduled-upgrade-check-v3-2-test.yml
+++ b/.github/workflows/scheduled-upgrade-check-v3-2-test.yml
@@ -23,7 +23,8 @@ on: # yamllint disable-line rule:truthy
- cron: '0 6 * * 2,4'
workflow_dispatch:
permissions:
- contents: read
+ contents: write
+ pull-requests: write
jobs:
upgrade-v3-2-test:
name: "[v3-2-test] Upgrade"
