[CI] Grant id-token to benchmark wheel-build jobs for Sigstore signing - #7911
Draft
quinnlp wants to merge 1 commit into
Draft
[CI] Grant id-token to benchmark wheel-build jobs for Sigstore signing#7911quinnlp wants to merge 1 commit into
quinnlp wants to merge 1 commit into
Conversation
quinnlp
force-pushed
the
quinnlp/token
branch
from
September 1, 2026 14:33
7310751 to
d437d4e
Compare
quinnlp
marked this pull request as draft
September 1, 2026 14:34
kwasd
self-requested a review
September 1, 2026 14:40
kwasd
approved these changes
Sep 1, 2026
…signing PR #7840 added a keyless Sigstore signing step to the reusable build-benchmarks-wheel.yml, which requires `id-token: write`. The workflows that call it granted `permissions: read-all`, which does not include id-token (id-token is write-only and not part of read-all). A job that calls a reusable workflow with `uses:` can only downgrade, not elevate, the caller workflow's top-level token permissions, so the grant must be at the caller top level (a job-level block on the calling job is capped to the top-level default and has no effect). Because `read-all` cannot be combined with an explicit `id-token: write`, the permissions are spelled out to the scopes the workflows actually use: contents (checkout), actions (artifact download, including the reports cross-run comparison in the test path), and id-token (signing). Without this, every triggered benchmark workflow failed at startup validation ("workflow file issue", startup_failure) with zero jobs. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
quinnlp
force-pushed
the
quinnlp/token
branch
from
September 1, 2026 14:46
d437d4e to
0fb9724
Compare
Contributor
Author
|
@kwasd unfortunately this did not fix the issue. The PR still cannot trigger vLLM, SGLang, or Triton benchmarks. Example: https://github.com/intel/intel-xpu-backend-for-triton/actions/runs/33521556809 Could you take over this please? Here is an example of the original issue I was trying to fix: https://github.com/intel/intel-xpu-backend-for-triton/actions/runs/33517960494 |
Contributor
|
ok will check |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
PR #7840 added a keyless Sigstore signing step to the reusable build-benchmarks-wheel.yml, which requires
id-token: write. The workflows that call it only grantedpermissions: read-all, which excludes id-token. A reusable workflow cannot request more token permissions than its caller, so every triggered benchmark workflow failed at startup validation ("workflow file issue", startup_failure) with zero jobs.Add a job-level
permissionsblock grantingcontents: readandid-token: writeon each build-wheel job that calls the reusable signing workflow, leavingread-allintact for all other jobs.