ci(release): grant packages: write to fix Release startup_failure

[Ryan Zhu (underthestars-zhy)]

Why

Every push to main since Jul 19 fails the Release workflow at startup with startup_failure and zero jobs (e.g. run 29706990353 for #79 — same for #81 and #82). As a result, #79's release-labeled merge never published a version.

Root cause: buildspace commit 2535977 (Jul 17) added a github-packages-publish job with permissions: packages: write to the shared typescript-service-release.yaml reusable workflow. GitHub validates a called workflow's job-level permissions against the caller's grant when compiling the workflow graph — before evaluating if: — so even though that job is opt-in (publish-github-packages defaults to false and would be skipped), the entire run is rejected at startup because our caller only granted contents: write, pull-requests: read, id-token: write.

Evidence: the last successful release (Jul 14) resolved buildspace@main at c3c48ac (pre-change); all Jul 19 failures resolved 43f12a6 (post-change). The only structural diff in the reusable workflow between those SHAs is the new job with packages: write.

Fix

Grant packages: write in the release job's permissions block. This only widens what the called workflow is allowed to request; the GitHub Packages publish job itself stays opt-in and skipped for this repo.

After merging

Merging this PR alone won't publish the pending releases (this PR has no release label). Either add the release label to this PR before merging, or trigger the Release workflow via workflow_dispatch with release: true afterwards to ship the accumulated #79/#81/#82 changes. photon-hq/uri calls the same reusable workflow without packages and will need the same one-liner before its next release.

Note on agent rules

AGENTS.md forbids agents from modifying .github/workflows/; this change was explicitly requested by the user to repair the release pipeline, and CI has no policy check on workflow files (only snapshot-policy and deps-policy).

Upstream version

(none — no API changes)

Routes added/removed/changed

(none)

Snapshot changes

• (none)

New runtime dependencies

• (none)

Checklist

• API type changes come from a @photon-ai/dashboard-api version bump, not hand edits (n/a — no type changes)
• No new runtime deps
• All snapshot diffs explained above (none)
• bun run check passes locally (not run — workflow-only change, no code touched; CI runs it on this PR)

  

---

^{Need help on this PR? Tag /codesmith with what you need. Autofix is disabled.}

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 5afb36ec-1274-4b1c-b8af-c16dafc3149a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch cursor/release-workflow-packages-permission-0724

---

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.