Fix release workflow reusable permissions

[Ryan Zhu (underthestars-zhy)]

Summary

• grant packages: write to the BuildSpace reusable release workflow
• document why the permission is required even when GitHub Packages publishing is skipped

Root cause

GitHub validates nested reusable-workflow permissions before evaluating job conditions. BuildSpace's new github-packages-publish job requests packages: write, but this caller previously allowed only packages: none, so the Release workflow failed at startup without creating any jobs.

Validation

• git diff --check
• bun x ultracite check (passes with the repository's existing broken-symlink warning)

---

^{Need help on this PR? Tag /codesmith with what you need. Autofix is disabled.}

---

Note

Low Risk
CI-only permission change with no application or data-handling impact.

Overview
Fixes Release workflow startup failures by granting packages: write on the job that calls BuildSpace’s reusable typescript-service-release.yaml.

GitHub checks nested reusable-workflow job permissions before job if conditions run. The reusable workflow’s github-packages-publish job needs packages: write, but the caller previously did not pass that through, so the workflow failed before any jobs ran—even when GitHub Packages publishing was skipped.

A short comment in release.yaml documents why this permission is required despite optional publishing.

^{Reviewed by Cursor Bugbot for commit dbe21b9. Bugbot is set up for automated code reviews on this repo. Configure here.}

Summary by CodeRabbit

• Chores
  • Updated release automation permissions to support publishing packages.
  • Added clarification to the workflow’s permissions configuration.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: e8f1324a-b477-47d3-b236-29102644594b

📥 Commits

Reviewing files that changed from the base of the PR and between c5d5d6a and dbe21b9.

📒 Files selected for processing (1)

• .github/workflows/release.yaml

📜 Recent review details

⏰ Context from checks skipped due to timeout. (1)

• GitHub Check: Cursor Bugbot

🔇 Additional comments (1)

.github/workflows/release.yaml (1)

12-13: LGTM!

---

📝 Walkthrough

Walkthrough

The release workflow’s job permissions now include packages: write, with an inline comment explaining GitHub’s validation of nested job permissions.

Changes

Release workflow permissions

Layer / File(s)	Summary
Enable package publishing permission .github/workflows/release.yaml	Adds packages: write to the release job permissions and documents GitHub’s nested permission validation behavior.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Poem

I’m a rabbit with packages to ship,
Permission granted for every hop and skip.
The release train rolls bright and neat,
With write access tucked beneath its feet.
Thump-thump—deployments are complete!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: adjusting reusable release workflow permissions.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/fix-release-packages-permission

---

_{Comment @coderabbitai help to get the list of available commands.}