Repository navigation
[ci] Allow publisher checks to access GitHub drafts - #109
Merged
nhairs merged 1 commit intoOct 31, 2026
Merged
Conversation
The `v4.3.0.dev3` release passed build and draft staging, then failed after approval with `Missing or changed release draft`. The publishing job had `contents: read`, but GitHub only includes draft releases for callers with push access. Grant `contents: write` to the approved publishing job so its readiness checks can inspect the draft and exact assets. Explain the permission in the workflow and release guide. The `pypi` approval gate, script-only checkout, OIDC permission, package bytes and publication order remain unchanged. Observed failure: https://github.com/nhairs/python-json-logger/actions/runs/41155252543 GitHub permission behavior: https://docs.github.com/en/rest/releases/releases#list-releases The failed run skipped the PyPI action and retained publication evidence with zero attestations. Its replacement build and staging succeeded after moving the unpublished tag to a new commit. Once this fix is merged, a new tag push to the corrected commit is needed: rerunning the existing tagged workflow retains its old permissions. nhairs-bot-ref: T0027 ## Test Plan - actionlint passed for release.yml; git diff --check passed. - Inspected failed-job logs and retained publication evidence: upload was skipped, so this failure happened before package upload/signing. - Live verification of draft access and publication requires an owner-triggered corrected-tag run after merge. No tags, releases, uploads or repository settings were changed while preparing this fix.
nhairs
approved these changes
Oct 31, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The
v4.3.0.dev3release passed build and draft staging, then failed after approval withMissing or changed release draft. The publishing job hadcontents: read, but GitHub only includes draft releases for callers with push access.Grant
contents: writeto the approved publishing job so its readiness checks can inspect the draft and exact assets. Explain the permission in the workflow and release guide. Thepypiapproval gate, script-only checkout, OIDC permission, package bytes and publication order remain unchanged.Observed failure: https://github.com/nhairs/python-json-logger/actions/runs/41155252543
GitHub permission behavior: https://docs.github.com/en/rest/releases/releases#list-releases
The failed run skipped the PyPI action and retained publication evidence with zero attestations. Its replacement build and staging succeeded after moving the unpublished tag to a new commit. Once this fix is merged, a new tag push to the corrected commit is needed: rerunning the existing tagged workflow retains its old permissions.
nhairs-bot-ref: T0027
Test Plan