`needs`/`if` should prevent errors about nested jobs violating permissions

https://github.com/actions/runner/blob/c96dcd472907e514274cdb4af281116adf7aad18/src/Sdk/WorkflowParser/Conversion/PermissionsHelper.cs#L43

https://github.com/check-spelling-sandbox/rancher-dashboard/actions/runs/20184527336/workflow

Annotations

1 error
Invalid workflow file: .github/workflows/test-extension-workflows-release-2.8.yml#L63
The workflow is not valid. .github/workflows/test-extension-workflows-release-2.8.yml (Line: 63, Col: 3): Error calling workflow 'rancher/dashboard/.github/workflows/release-shell-pkg.yaml@release-2.8'. The nested job 'build' is requesting 'packages: write', but is only allowed 'packages: read'.

Repository authors will do this (this repository did it repeatedly) and there doesn't seem to be a good reason to demand authors get this right.

There doesn't appear to be any way to guard against this, as even if doesn't help:

https://github.com/check-spelling-sandbox/rancher-dashboard/actions/runs/20199790260/workflow

Annotations

1 error
Invalid workflow file: .github/workflows/test-extension-workflows-release-2.9.yml#L64
The workflow is not valid. .github/workflows/test-extension-workflows-release-2.9.yml (Line: 64, Col: 3): Error calling workflow 'rancher/dashboard/.github/workflows/release-shell-pkg.yaml@release-2.9'. The nested job 'build' is requesting 'packages: write', but is only allowed 'packages: read'.

Start in src/Sdk/WorkflowParser/Conversion/PermissionsHelper.cs around line 43, then compare its validation with the linked failing workflow runs and nested workflow examples. The work is done when jobs guarded by needs or if no longer produce permission-violation errors for nested jobs when the guarded path will not run.