fix: add actions: read to smoke-trigger and smoke-multi-caller caller permissions

[Copilot]

smoke-trigger and smoke-multi-caller have been producing startup_failure on every PR label event because the activation job inside the called reusable workflows (smoke-workflow-call.lock.yml, smoke-workflow-call-with-inputs.lock.yml) declares permissions: actions: read, but neither caller was granting it. GitHub Actions validates called-workflow job permissions against the caller's granted permissions before evaluating if: conditions, so even label events that would have skipped the job cause startup_failure instead of skipped.

smoke-water.yml was unaffected — it already had actions: read.

Changes

• smoke-trigger.yml — add actions: read to call-smoke-workflow-call job permissions
• smoke-multi-caller.yml — add actions: read to all three caller jobs (task-a, task-b, task-c)

# before (smoke-trigger.yml)
permissions:
  contents: read
  discussions: write
  issues: write
  pull-requests: write

# after
permissions:
  actions: read        # required by activation job in called workflow
  contents: read
  discussions: write
  issues: write
  pull-requests: write

• Fixes [aw] Smoke Trigger / Smoke Multi Caller — startup_failure regression since Jul 22 #47719

[github-actions]

🤖 PR Triage

Field	Value
Category	bug
Risk	🟢 Low
Score	68 / 100
Action	⚡ fast_track

Score breakdown: Impact 35 · Urgency 22 · Quality 11

Summary: Minimal, high-confidence permissions fix that stops startup_failure on every PR label event in smoke-trigger and smoke-multi-caller. DRAFT — undraft and CI pass needed before merge.

Next action: Undraft → CI → fast-track human review.

Generated by 🔧 PR Triage Agent · sonnet46 · 49.5 AIC · ⌖ 5.34 AIC · ⊞ 5.7K · ◷

[Copilot]

Pull request overview

Adds required actions: read permissions to reusable smoke workflow callers, preventing startup failures.

Changes:

• Updates Smoke Trigger’s caller permissions.
• Updates all three Smoke Multi Caller jobs.

Show a summary per file

File	Description
.github/workflows/smoke-trigger.yml	Grants required Actions read access.
.github/workflows/smoke-multi-caller.yml	Grants Actions read access to all caller jobs.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 2/2 changed files
• Comments generated: 0
• Review effort level: Medium

[github-actions]

🧠 Matt Pocock Skills Reviewer has completed the skills-based review. ✅

[github-actions]

✅ PR Code Quality Reviewer completed the code quality review.

[github-actions]

✅ Design Decision Gate 🏗️ completed the design decision gate check.

No ADR enforcement needed: PR does not have the 'implementation' label and has ≤100 new lines of code in business logic directories (0 lines detected).

[github-actions]

✅ Test Quality Sentinel completed test quality analysis.

No test files were added or modified in this PR. Test Quality Sentinel skipped. PR #47721 only modifies workflow YAML files (.github/workflows/smoke-*.yml) to add permissions.

[github-actions]

The fix is correct. Both smoke-trigger.yml and smoke-multi-caller.yml were missing actions: read in their caller job permissions, causing GitHub Actions to fail with startup_failure before even evaluating if: conditions. Adding the permission to all four affected jobs is the right surgical fix. smoke-water.yml already had this permission and is unaffected.

🧵 Reviewed using Impeccable skills by Impeccable Skills Reviewer · sonnet46 · 12.9 AIC · ⌖ 4.46 AIC · ⊞ 5K

[github-actions]

Skills-Based Review 🧠

Applied /diagnosing-bugs — changes look correct and complete.

📋 Summary

• ✅ Root cause correctly identified: GitHub Actions validates called-workflow job permissions against caller permissions before evaluating if: conditions, causing startup_failure instead of skipped.
• ✅ Fix applied consistently to all three jobs in smoke-multi-caller.yml and the single job in smoke-trigger.yml.
• ✅ smoke-water.yml correctly left untouched — it already had actions: read.
• No test coverage concern: these are CI smoke workflows; the fix self-validates on the next PR label event.

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer · sonnet46 · 14.7 AIC · ⌖ 4.51 AIC · ⊞ 6.7K
_{Comment /matt to run again}

[github-actions]

✅ Approved — minimal, correct permission fix

Adds actions: read to the 4 caller jobs that were missing it. GitHub Actions validates called-workflow job permissions against the caller-granted set before evaluating if: conditions, so the missing permission was the confirmed cause of startup_failure on label events.

• All three jobs in smoke-multi-caller.yml patched symmetrically.
• smoke-trigger.yml patched.
• smoke-water.yml correctly left untouched (already had the permission).
• actions: read is least-privilege (read-only). No logic, conditionals, or interpolation introduced.

No blocking issues found.

🔎 Code quality review by PR Code Quality Reviewer · sonnet46 · 19.4 AIC · ⌖ 4.5 AIC · ⊞ 5.7K
_{Comment /review to run again}

[github-actions]

🤖 PR Triage

Field	Value
Category	bug
Risk	low
Priority Score	78/100
Score Breakdown	Impact: 35 · Urgency: 28 · Quality: 15
Recommended Action	fast_track
CI	✅ passing (30 checks)

Rationale: Tiny 2-file fix (+4/-0) that unblocks every PR label event triggering smoke tests. High urgency — startup_failure on every run. CI fully green. Immediate fast-track review recommended.

Generated by 🔧 PR Triage Agent · sonnet46 · 32.4 AIC · ⌖ 5.13 AIC · ⊞ 5.7K · ◷

[github-actions]

🎉 This pull request is included in a new release.

Release: v0.83.3