[ModeSevenIndustrialSolutions]

Every pull request is failing to start Python Build/Test

main is broken, and quietly. Same defect as lfreleng-actions/github2gerrit-action#408, which diagnosed it there.

python-workflows v0.3.1 added a permission request to one of its jobs:

      issues: read  # Read maintainer-approved CVE bypass issues

A called workflow cannot hold a permission the caller has not granted. Neither caller here grants issues: read, so the run fails at startup, before any job exists.

Workflow	requests	this repo grants
python-workflows/build-test.yaml@v0.3.1	contents: read, pull-requests: read, issues: read	contents: read, pull-requests: read
python-workflows/build-test-release.yaml@v0.3.1	contents: read/write, id-token: write, attestations: write, issues: read	contents: write, id-token: write, attestations: write

The bump landed on 2026-08-31 in #471 and the equivalent for build-test.yaml.

Why nobody noticed

Python Build/Test    completed    startup_failure
jobs: 0

There is no failing job to open and no annotation naming the cause, and startup_failure produces no check run at all — so Python Tests (3.10–3.14), Python Audit, Python Build, Generate SBOM and Grype Audit SBOM vanish from the checks list rather than turning red. A PR looks green because the checks that would have failed are absent.

Confirmed on every commit pushed to feat/flexible-url-handling since the bump — eleven runs, all startup_failure, all with zero jobs:

2fde3765  startup_failure     184ee008  startup_failure     b1f8644d  startup_failure
c0d3aa2b  startup_failure     2965bf7e  startup_failure     ae5cbeac  startup_failure
d56c8646  startup_failure     f42b2137  startup_failure     f298cd42  startup_failure
a4d043d9  startup_failure     7ba4280c  startup_failure

What I ruled out first

I initially reached the wrong conclusion here, by reading the copy of build-test.yaml on a feature branch that predates the bump — it still showed v0.3.0, which does not request issues: read. For a pull_request event the workflow comes from the merge ref, so a branch that does not touch .github/ runs main's copy, which is v0.3.1. Worth stating because it is an easy way to mis-diagnose this.

Having corrected that, I eliminated the other causes of startup_failure rather than guessing from the name:

pin 23636ccc exists in python-workflows          -> HTTP 200
v0.3.1 tag resolves to exactly that commit       -> yes
reusable declares required secrets               -> none
caller passes inputs the reusable may reject     -> caller passes no inputs at all

Diffing the job-level permissions: blocks between the two pins isolates the one change that matters:

v0.3.0 (66435dec): contents: read, pull-requests: read
v0.3.1 (23636ccc): contents: read, pull-requests: read, issues: read   <- line 661

The change

Two lines, one per caller. Nothing else.

Also drops two comments reading # Pinned to python-workflows v0.1.0 release commit and v0.1.1 while sitting beside a pin annotated v0.3.1. Neither survived a version bump, so the annotation on the uses: line is the only record worth keeping.

Verification

zizmor (per AGENTS.md §2.5), actionlint and yamllint all clean:

$ zizmor .github/workflows/
No findings to report. Good job!
$ prek run actionlint  --files .github/workflows/build-test*.yaml   # Passed
$ prek run yamllint    --files .github/workflows/build-test*.yaml   # Passed

This PR cannot exercise the fix itself. build-test.yaml filters '!.github/**', and this change touches nothing else, so Python Build/Test will not appear on this PR at all — its absence here is the path filter, not the bug. The first PR afterwards that touches a non-.github path will show the build-test jobs, or it will not. #475 is the obvious candidate.

Related

gerrit-clone-action has byte-identical callers and is failing the same way; a matching PR follows there.

[Copilot]

🟢 Approval recommended

Pull request overview

Grants reusable Python workflows the required read access to CVE bypass issues, preventing startup failures.

Changes:

• Adds issues: read to build/test and release jobs.
• Removes outdated pin-version comments.

File summaries

File	Description
.github/workflows/build-test.yaml	Grants issue read access to the reusable test workflow.
.github/workflows/build-test-release.yaml	Grants issue read access to the reusable release workflow.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 0
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[ModeSevenIndustrialSolutions]

Don't fix here, the fix needs to land elsewhere.