ci(release): Fix weekly release workflow permissions

[OmarAglan]

• Fixes the startup failure in https://github.com/TheSuperHackers/GeneralsGameCode/actions/runs/33876554672

Adds packages: write to the Weekly Release workflow permissions.

The reusable toolchain workflow began requesting this permission when the vcpkg binary cache moved to GitHub Packages, but the Weekly Release caller was not updated. Because explicitly omitted permissions default to none, GitHub rejected the caller before any jobs could start.

This restores the caller or callee permission contract and allows scheduled and manually dispatched weekly releases, including releases run from forks, to start normally.

[qodo-free-for-open-source-projects]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can route each action level your way: inline, summary, both, or drop

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[qodo-free-for-open-source-projects]

PR Summary by Qodo

Fix weekly release permissions for GitHub Packages

🐞 Bug fix ⚙️ Configuration changes 🕐 Less than 5 minutes

AI Description

• Grants weekly releases write access to GitHub Packages.
• Restores permission compatibility with reusable toolchain builds and vcpkg caching.

High-Level Assessment

The explicit caller permission is the correct approach because GitHub reusable workflows cannot elevate permissions beyond those granted by their caller. Granting packages: write restores the existing caller-callee contract without restructuring the workflows.

Files changed (1) +1 / -0

Bug fix (1) +1 / -0

weekly-release.ymlGrant package write permission to weekly releases +1/-0

Grant package write permission to weekly releases

• Adds 'packages: write' to the workflow-level permissions so reusable toolchain jobs can access the GitHub Packages-backed vcpkg binary cache without startup rejection.

.github/workflows/weekly-release.yml

[greptile-apps]

Greptile Summary

The PR grants the weekly release workflow the package-write permission required by its reusable toolchain builds, addressing startup rejection and enabling the vcpkg GitHub Packages cache. The permission is currently broader than necessary because it is inherited by every job.

• Restores the caller/callee permission contract for both weekly build jobs.
• Applies to scheduled and manually dispatched releases.
• Could be narrowed to the two reusable build jobs to preserve least privilege.

Confidence Score: 4/5

The workflow fix appears safe to merge, with a non-blocking opportunity to restrict package-write access to the build jobs that require it.

The new permission correctly restores the reusable build contract; the only finding is the avoidable token-privilege expansion caused by declaring it at workflow scope.

Files Needing Attention: .github/workflows/weekly-release.yml

Important Files Changed

Filename	Overview
.github/workflows/weekly-release.yml	Adds the package-write grant required by reusable toolchain builds, but grants it to unrelated workflow jobs as well.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
    T[Scheduled or manual trigger] --> D[Date and change detection]
    D --> G[Generals build]
    D --> Z[GeneralsMD build]
    G --> C[Reusable toolchain and package cache]
    Z --> C
    G --> R[Create release]
    Z --> R
    P[packages: write at workflow scope] --> D
    P --> G
    P --> Z
    P --> R

Loading

Prompt To Fix All With AI

### Issue 1
.github/workflows/weekly-release.yml:6
**Package Permission Is Overbroad**

Declaring `packages: write` at workflow scope also grants package publication access to `get-date`, `detect-scm-changes`, and `create-release`, even though only the two reusable build jobs need it. Scope this permission to `build-generals` and `build-generalsmd` so unrelated actions and scripts do not receive an unnecessarily privileged token.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

_{Reviews (1): Last reviewed commit: "ci(release): Fix weekly release workflow..." | Re-trigger Greptile}

[stephanmeesters]

What about build-historical.yml?

[OmarAglan]

What about build-historical.yml?

build-historical.yml is not affected because it does not call the reusable build-toolchain.yml workflow. It defines its VC6 build steps directly and does not use a vcpkg preset or the GitHub Packages NuGet feed, so it does not request packages: write.

The permission mismatch applies to callers of build-toolchain.yml, ci.yml already grants packages: write, while weekly-release.yml was the missing caller fixed by this PR.

[OmarAglan]

works on manual run here:
https://github.com/OmarAglan/GeneralsGameCode/actions/runs/33916145750
i did only make the run Pre-release here:
https://github.com/OmarAglan/GeneralsGameCode/releases/tag/weekly-2026-09-04

[xezon]

Greptile Bot noted:

The workflow fix appears safe to merge, with a non-blocking opportunity to restrict package-write access to the build jobs that require it.

The new permission correctly restores the reusable build contract; the only finding is the avoidable token-privilege expansion caused by declaring it at workflow scope.

[OmarAglan]

Greptile Bot noted:

The workflow fix appears safe to merge, with a non-blocking opportunity to restrict package-write access to the build jobs that require it.

The new permission correctly restores the reusable build contract; the only finding is the avoidable token-privilege expansion caused by declaring it at workflow scope.

from my understanding, this also do exist in ci.yml, and it has to do with permission "packages: write" available to every step of GitHub actions, i can fix both permissions, but its not required for this to work, at the moment!