René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"write permission is conditionally needed by release-drafter","articleBody":"The cpp-linter repo has 2 workflows that call into the reusable workflow, `.github/workflows/release-drafter.yml`:\n1. cpp-linter/cpp-linter/.github/workflows/labeler.yml requires\n   ```yml\n   permissions:\n     contents: read\n     pull-requests: write\n   ```\n2. cpp-linter/cpp-linter/.github/workflows/release-drafter.yml; requires\n   ```yml\n   permissions:\n     contents: write\n     pull-requests: read\n   ```\n\nWhile the reusable workflow demands write permission regardless of calling context: \nhttps://github.com/cpp-linter/.github/blob/86b6518d4136a9a82ea8c9f040d282efd9c88313/.github/workflows/release-drafter.yml#L15-L19\n\n## Proposal\n\nThe `permissions` map cannot be dynamically set.\n\n```yml\n# THIS WILL NOT WORK!\npermissions:\n  contents: ${{ inputs.mk-labels \u0026\u0026 'read' || 'write' }}\n  pull-requests: ${{ inputs.mk-draft-release \u0026\u0026 'read' || 'write' }}\n```\nThis means we need 2 separate reusable workflows for each calling context:\n- To auto-label PRs\n- To draft (or update a drafted) release\n\nBecause the reusable workflow is just 1 step, I'm inclined to just copy that 1 step into the calling workflows' yml and modify the permissions as needed.\n\n### Or use [git-cliff] + [gh-cli]\n\nIn the cpp-linter-rs repo, I use a script (written in python) to\n\n1. Bump the version according to `inputs.component`. In rust this requires altering the Cargo.toml manifest. In python we would only need to calculate the version based on the last tag.\n2. Use [git-cliff] with the new version number to generate release notes (used in the final step 4). This step also regenerates the entire CHANGELOG.md in repo root.\n3. Use `git` to push any metadata file changes. The step is not required where `setuptools-scm` automatically sets the package version based on `git describe --tags` (or similar).\n4. Use [gh-cli] (requires a PAT with `permissions: {contents: write}`) to publish a release, which inherently creates a new tag that triggers build/deploy CI workflows.\n\n\u003e [!caution]\n\u003e step 4 requires a PAT instead of the generic/default `secrets.GITHUB_TOKEN` because CI triggers are ignored for events caused by \"github-actions[bot]\".\n\nThis might seem overly complicated, but it provides much better flexibility and does not surrender security to third-party software that we don't control/understand.\n\n[gh-cli]: https://cli.github.com/\n[git-cliff]: https://git-cliff.org/\n","author":{"url":"https://github.com/2bndy5","@type":"Person","name":"2bndy5"},"datePublished":"2025-09-04T12:47:04.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":17},"url":"https://github.com/47/.github/issues/47"}