fix: move pages/id-token permissions to deploy job to fix action_required regression - #47201
Merged
Merged
Conversation
…ired regression Elevated permissions (pages: write, id-token: write) at the workflow level cause GitHub to block the entire workflow run with action_required when triggered by pull_request events from github-actions[bot] (copilot branch syncs), even though the deploy job has an if: condition that skips it. Move those permissions to the deploy job level only. PR runs now have only contents: read at workflow level, so the block never triggers. Push-to-main runs deploy normally using the job-level permissions. Closes #47194 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Copilot
AI
changed the title
[WIP] Fix deploy issue causing 100% action_required
fix: move pages/id-token permissions to deploy job to fix action_required regression
Jul 22, 2026
Contributor
🤖 PR Triage
Tiny fix (+4/-3) that resolves 100%
|
pelikhan
approved these changes
Jul 22, 2026
Contributor
There was a problem hiding this comment.
Pull request overview
Scopes elevated GitHub Pages permissions to the deployment job, preventing blocked PR documentation builds.
Changes:
- Keeps workflow-level access read-only.
- Grants Pages and OIDC write access only to deployments.
Show a summary per file
| File | Description |
|---|---|
.github/workflows/docs.yml |
Moves elevated permissions to the conditional deploy job. |
Review details
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 1/1 changed files
- Comments generated: 0
- Review effort level: Medium
Contributor
|
🎉 This pull request is included in a new release. Release: |
This was referenced Jul 29, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Doc Build - Deploywas producing 100%action_requiredruns (0 jobs, instant completion) on every PR triggered bygithub-actions[bot](copilot branch auto-syncs). Push-to-main and Dependabot PR runs were unaffected.Root cause:
pages: writeandid-token: writewere declared at the workflow level. GitHub evaluates elevated permissions against the triggering actor before any jobif:conditions are checked — so even though thedeployjob hasif: github.ref == 'refs/heads/main' || ...that would skip it for PRs, the entire workflow run was blocked withaction_requiredand never started.Fix: Move
pages: writeandid-token: writefrom workflow level to thedeployjob:PR runs now only carry
contents: readat the workflow level; the elevated permissions are never requested because the deploy job is skipped. Push-to-main/release/dispatch runs continue to deploy normally using the job-level grant.