From ba353eadbd3eb6632764946ae6b2b1a69e604b7a Mon Sep 17 00:00:00 2001 From: GameTec_live Date: Mon, 10 Aug 2026 21:53:31 +0200 Subject: [PATCH] fix: inherit permissions instead The PR caller doesnt allow package write, the builder requested it always. Inherit it from caller instead -> Write on push and no write on PR Also fix a potential race conditions when fast, consecutive pushes can result in a invalid comment state. --- .github/workflows/build_firmware.yml | 5 +---- .github/workflows/on_pr_comment.yml | 11 +++++++++++ 2 files changed, 12 insertions(+), 4 deletions(-) diff --git a/.github/workflows/build_firmware.yml b/.github/workflows/build_firmware.yml index 47eacde2..edda9bc5 100644 --- a/.github/workflows/build_firmware.yml +++ b/.github/workflows/build_firmware.yml @@ -15,10 +15,7 @@ on: jobs: build_fw_builder: name: Build fw-builder Docker image - runs-on: ubuntu-latest - permissions: - packages: write - contents: read + runs-on: ubuntu-latest # Inherits permissions from caller outputs: image_ref: ${{ steps.published-image.outputs.image_ref || steps.local-image.outputs.image_ref }} steps: diff --git a/.github/workflows/on_pr_comment.yml b/.github/workflows/on_pr_comment.yml index 26c5a0bd..96aa1e81 100644 --- a/.github/workflows/on_pr_comment.yml +++ b/.github/workflows/on_pr_comment.yml @@ -38,6 +38,17 @@ jobs: return; } + const { data: pull } = await github.rest.pulls.get({ + owner: context.repo.owner, + repo: context.repo.repo, + pull_number: pullNumber, + }); + + if (pull.head.sha !== run.head_sha) { + core.notice(`Skipping superseded workflow run ${run.id}`); + return; + } + const marker = ''; const lines = [marker, `# Build result for commit ${run.head_sha}`, ''];