Problem

The stale workflow was failing due to a permissions mismatch when calling the reusable workflow at cpp-linter/.github/.github/workflows/stale.yml@main. The error indicated that the calling workflow did not provide sufficient permissions for the reusable workflow's job-level permissions to inherit from, resulting in:

• Job 'stale' requesting: contents: read, pull-requests: write
• But only being allowed: contents: none, pull-requests: none

Solution

Updated .github/workflows/stale.yml to follow the principle of least privilege by moving permissions from workflow-level to job-level:

Before:

permissions:
  issues: write

jobs:
  stale:
    uses: cpp-linter/.github/.github/workflows/stale.yml@main

After:

permissions: {}

jobs:
  stale:
    permissions:
      contents: read
      issues: write
      pull-requests: write
    uses: cpp-linter/.github/.github/workflows/stale.yml@main

Changes

• Set workflow-level permissions to {} (empty object)
• Added job-level permissions with exactly what the reusable workflow requires:
  • contents: read - for reading repository contents
  • issues: write - preserved from original (needed for stale issue management)
  • pull-requests: write - added to resolve the missing permission error

This change aligns with the pattern already used in other workflows in this repository (codeql.yml, pre-commit.yml, docs.yml) and resolves the permissions compatibility issue with the reusable workflow.

Fixes #159

This pull request was created as a result of the following prompt from Copilot chat.

The stale workflow in cpp-linter/cpp-linter is failing due to a permissions mismatch when calling the reusable workflow at cpp-linter/.github/.github/workflows/stale.yml. The error indicates that the calling workflow does not provide sufficient permissions for the reusable workflow's job-level permissions to inherit from, resulting in the job 'stale' requesting 'contents: read, pull-requests: write', but only being allowed 'contents: none, pull-requests: none'.

To fix this:

1. Set workflow-level permissions to {} in .github/workflows/stale.yml.
2. Add job-level permissions for the stale job as follows:

permissions: {}

jobs:
  stale:
    permissions:
      contents: read
      issues: write
      pull-requests: write
    uses: cpp-linter/.github/.github/workflows/stale.yml@main

References:

• Original PR: fix: add permissions section to stale.yml workflow .github#55
• Issue: fix: update stale workflow permissions for reusable workflow compatibility #159

Update the stale workflow so that it is compatible with the reusable workflow and permissions are set according to the principle of least privilege.

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.