deploy-infra.yml cannot be dispatched. Every run since #1122 merged ends in
startup_failure with no jobs, no logs and no annotations — GitHub reports only
"This run likely failed because of a workflow file issue."
Measured on run 30780208497 (ref 32cfa5c3):
- conclusion
startup_failure
gh api .../jobs → 0 jobsgh run view --log-failed → "log not found"- annotations → empty
The last successful start was caeff696, before #1122 added the workflow's two
reusable calls.
Where it points
deploy-infra.yml declares permissions: contents: read at the workflow level.
Both workflows it calls declare a job that asks for more:
.github/workflows/build-c.yml:247 — upload-to-release, contents: write.github/workflows/build-runner-binary.yml:197 — upload-to-release, contents: write
GitHub documents that "permissions can only be maintained or reduced—not
elevated—throughout the chain"
(reuse-workflows).
Both of those jobs sit behind a release if: gate, but the run produced no jobs at
all, so that gate cannot be assumed to keep their declaration out of what the caller
has to grant.
Not established: that this is what rejected the run. The docs describe the
ceiling, not what happens when a callee asks past it, and the platform named no
cause. Other candidates were eliminated (inputs match, no secrets: passing,
nesting within limits, YAML parses), but confirmation needs a dispatch.
Why nothing caught it
actionlint exits 0 on the exact file GitHub rejected, and it is not wired into CI
anywhere (see also #1053). The repo has no other workflow linter.
lint.yml's infra path filter named deploy-infra.yml alone, so editing a
reusable workflow skipped the contract suite that reads the whole workflow
directory.
Impact
No infrastructure deployment can be triggered. There is no partial failure to
diagnose from — the run never starts.
deploy-infra.ymlcannot be dispatched. Every run since #1122 merged ends instartup_failurewith no jobs, no logs and no annotations — GitHub reports only"This run likely failed because of a workflow file issue."
Measured on run
30780208497(ref32cfa5c3):startup_failuregh api .../jobs→ 0 jobsgh run view --log-failed→ "log not found"The last successful start was
caeff696, before #1122 added the workflow's tworeusable calls.
Where it points
deploy-infra.ymldeclarespermissions: contents: readat the workflow level.Both workflows it calls declare a job that asks for more:
.github/workflows/build-c.yml:247—upload-to-release,contents: write.github/workflows/build-runner-binary.yml:197—upload-to-release,contents: writeGitHub documents that "permissions can only be maintained or reduced—not
elevated—throughout the chain"
(reuse-workflows).
Both of those jobs sit behind a release
if:gate, but the run produced no jobs atall, so that gate cannot be assumed to keep their declaration out of what the caller
has to grant.
Not established: that this is what rejected the run. The docs describe the
ceiling, not what happens when a callee asks past it, and the platform named no
cause. Other candidates were eliminated (inputs match, no
secrets:passing,nesting within limits, YAML parses), but confirmation needs a dispatch.
Why nothing caught it
actionlintexits 0 on the exact file GitHub rejected, and it is not wired into CIanywhere (see also #1053). The repo has no other workflow linter.
lint.yml'sinfrapath filter nameddeploy-infra.ymlalone, so editing areusable workflow skipped the contract suite that reads the whole workflow
directory.
Impact
No infrastructure deployment can be triggered. There is no partial failure to
diagnose from — the run never starts.