From 9a62a656cd884a2d4a5978d8fa2eff38e96bbc73 Mon Sep 17 00:00:00 2001 From: Omar Nahhas Sanchez Date: Mon, 3 Aug 2026 16:03:01 +0300 Subject: [PATCH] ci: grant actions:write so the DEC-074 artifact prune can run MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The devkit's reusable plugin-e2e now enforces count-based artifact retention (keep the last 5 runs) by DELETING superseded artifacts via the Actions API. A reusable workflow's job permissions are CAPPED by the caller's grant, so without actions:write here the prune degrades to a warning and artifacts accumulate unbounded. Mirrors templates/plugin-e2e.caller.yml. devkit-sync cannot deliver this — it deliberately never writes .github/workflows/. --- .github/workflows/plugin-e2e.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/plugin-e2e.yml b/.github/workflows/plugin-e2e.yml index bd44bde..b1f7566 100644 --- a/.github/workflows/plugin-e2e.yml +++ b/.github/workflows/plugin-e2e.yml @@ -26,6 +26,7 @@ on: permissions: contents: read pull-requests: write # merge-guard drafts a PR whose plugin-e2e is red + actions: write # DEC-074 count-based artifact retention: delete superseded e2e artifacts jobs: e2e: