CI: Forgejo 16 ignores the workflow permissions field and warns on every job #727

New issue

Closed

opened 2026-10-06 20:44:50 +00:00 by tiagoagueda · 0 comments

tiagoagueda commented

2026-10-06 20:44:50 +00:00

Owner

Since Forgejo was updated to 16, every run of ci.yml shows this warning for each of its jobs (browser, test, checks, postgres, security):

Job … or its workflow has a permissions field, which is not supported in Forgejo and will be ignored. Use Authorized Integrations to grant capabilities to this job instead.

What is done here

ci.yml only ever asked for contents: read, which is what a job has without asking, so its top-level permissions: block is removed and the comment says why. zizmor, which the Security job runs over every workflow, asks for the block (excessive-permissions, medium), so .forgejo/zizmor.yml turns that one audit off for ci.yml and nowhere else. Checked with the pinned zizmor==1.30.1 and the CI command: clean with the exception, flagged without it.

What is not done here, and needs the instance

Four other workflows carry permissions: blocks that grant more than reading, and Forgejo 16 now ignores those too:

release.yml: contents: write, to publish the release.
image.yml: contents: write (attach the bill of materials) and packages: write (push the release image).
dev-image.yml: packages: write (push :dev).
dependencies.yml: contents: write and pull-requests: write (the monthly upgrade branch and its pull request).

They warn only when they run, and they are left as they are, because deleting a grant from the file would hide what each job needs. If the instance does not grant the same capabilities through Authorized Integrations, a release, an image push or the monthly upgrade can fail where they used to work. That is a setting on the Forgejo side; once it is made, those blocks can go the way ci.yml's did.

Since Forgejo was updated to 16, every run of `ci.yml` shows this warning for each of its jobs (`browser`, `test`, `checks`, `postgres`, `security`): > Job … or its workflow has a permissions field, which is not supported in Forgejo and will be ignored. Use Authorized Integrations to grant capabilities to this job instead. ## What is done here `ci.yml` only ever asked for `contents: read`, which is what a job has without asking, so its top-level `permissions:` block is removed and the comment says why. zizmor, which the Security job runs over every workflow, asks for the block (`excessive-permissions`, medium), so `.forgejo/zizmor.yml` turns that one audit off for `ci.yml` and nowhere else. Checked with the pinned `zizmor==1.30.1` and the CI command: clean with the exception, flagged without it. ## What is not done here, and needs the instance Four other workflows carry `permissions:` blocks that grant more than reading, and Forgejo 16 now ignores those too: - `release.yml`: `contents: write`, to publish the release. - `image.yml`: `contents: write` (attach the bill of materials) and `packages: write` (push the release image). - `dev-image.yml`: `packages: write` (push `:dev`). - `dependencies.yml`: `contents: write` and `pull-requests: write` (the monthly upgrade branch and its pull request). They warn only when they run, and they are left as they are, because deleting a grant from the file would hide what each job needs. If the instance does not grant the same capabilities through Authorized Integrations, a release, an image push or the monthly upgrade can fail where they used to work. That is a setting on the Forgejo side; once it is made, those blocks can go the way `ci.yml`'s did.

tiagoagueda referenced this issue from a commit

2026-10-06 20:45:31 +00:00

Drop the permissions block Forgejo 16 ignores from ci.yml

tiagoagueda added this to the 0.5.0 milestone

2026-10-07 08:34:09 +00:00

tiagoagueda self-assigned this

2026-10-10 12:12:09 +00:00

tiagoagueda referenced this issue from a commit

2026-10-10 18:34:45 +00:00

Drop the permissions blocks Forgejo 16 ignores from the release and image workflows

tiagoagueda referenced this issue from a commit

2026-10-10 18:35:44 +00:00