From 76e130b313a66b276e83d0aa10b698bec7f1f240 Mon Sep 17 00:00:00 2001
From: Kpa-clawbot <kpaclawbot@outlook.com>
Date: Sat, 13 Jun 2026 00:10:59 -0700
Subject: [PATCH] fix(#1702): grant actions: write to release-fast-path
 workflow (#1703)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

## Summary

Fixes the missing `actions: write` permission on
`.github/workflows/release-fast-path.yml` so the fallback `gh workflow
run deploy.yml` dispatch no longer returns HTTP 403.

## Triage verdict

From issue #1702 root-cause section:

> Fast-path workflow YAML likely lacks:
> ```yaml
> permissions:
>   contents: read
>   packages: write
>   actions: write   # MISSING — required to dispatch other workflows
> ```
> ## Fix
> One-line addition to `.github/workflows/release-fast-path.yml`
permissions block.

## Root cause

`.github/workflows/release-fast-path.yml` lines 16-18 (before this
change) only granted `contents: read` and `packages: write`. The
fallback step (`gh workflow run deploy.yml` when `:edge`'s
`org.opencontainers.image.revision` label doesn't match the tag SHA)
calls the GitHub Actions REST API, which requires `actions: write` on
`GITHUB_TOKEN`. Without it, the dispatch fails with `Resource not
accessible by integration` and the release stalls until an operator
manually re-runs the fast-path job after `:edge` rebuilds.

## Change

- `.github/workflows/release-fast-path.yml`: add `actions: write` to the
workflow-level `permissions:` block.
- `cmd/server/release_fast_path_workflow_test.go`: extend the existing
config-gate test (issue #1677) to require `actions: write` alongside the
previously asserted `contents: read` and `packages: write`.

Two commits, red→green:

1. `test(#1702): assert release-fast-path.yml requires actions: write` —
extends the assertion. Verified to fail on this commit
(`release-fast-path.yml: missing required permission "actions: write"`).
2. `fix(#1702): grant actions: write to release-fast-path workflow` —
adds the permission. Test green.

## TDD posture

The repo already had a YAML-config gate at
`cmd/server/release_fast_path_workflow_test.go` (parses the workflow as
text and asserts required permission strings). Strict TDD applied: red
commit extends the test, green commit fixes the workflow. No exemption
needed.

## Acceptance criteria (from #1702)

- [x] `permissions.actions: write` added to the fast-path workflow
- [ ] Manual test: tag a scratch SHA where `:edge` is stale; confirm
fallback dispatches deploy.yml without 403 — by-design out of CI scope
(would require a throwaway tag + race condition); covered by next real
release.
- [ ] Operator-felt: next release where notes-commit lands AFTER `:edge`
build completes works in one pass without manual rerun — verifiable only
on next release; in-scope of `Closes #1702` because bullet 1 (the
structural defect) is the cause of bullets 2 and 3.

## Preflight

`bash ~/.openclaw/skills/pr-preflight/scripts/run-all.sh origin/master`
→ **clean** (all hard gates pass, no warnings).

Closes #1702

---------

Co-authored-by: Kpa-clawbot <kpa-clawbot@users.noreply.github.com>
---
 .github/workflows/release-fast-path.yml       | 1 +
 cmd/server/release_fast_path_workflow_test.go | 6 ++++--
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/release-fast-path.yml b/.github/workflows/release-fast-path.yml
index dea88a4e..86abaf7f 100644
--- a/.github/workflows/release-fast-path.yml
+++ b/.github/workflows/release-fast-path.yml
@@ -16,6 +16,7 @@ on:
 permissions:
   contents: read
   packages: write
+  actions: write   # issue #1702: required so the fallback `gh workflow run deploy.yml` dispatch is allowed
 
 concurrency:
   group: release-fast-path-${{ github.ref }}
diff --git a/cmd/server/release_fast_path_workflow_test.go b/cmd/server/release_fast_path_workflow_test.go
index 42cc34f7..09ff6ad7 100644
--- a/cmd/server/release_fast_path_workflow_test.go
+++ b/cmd/server/release_fast_path_workflow_test.go
@@ -38,8 +38,10 @@ func TestReleaseFastPathWorkflowExists(t *testing.T) {
 		t.Errorf("release-fast-path.yml: missing required push.tags trigger 'v[0-9]+.[0-9]+.[0-9]+'")
 	}
 
-	// Permissions: needs packages:write to re-tag in GHCR, contents:read for checkout.
-	for _, perm := range []string{"packages: write", "contents: read"} {
+	// Permissions: needs packages:write to re-tag in GHCR, contents:read for
+	// checkout, and actions:write so the fallback `gh workflow run deploy.yml`
+	// dispatch is allowed (issue #1702 — fallback returned 403 without it).
+	for _, perm := range []string{"packages: write", "contents: read", "actions: write"} {
 		if !strings.Contains(src, perm) {
 			t.Errorf("release-fast-path.yml: missing required permission %q", perm)
 		}