From b2b70732c7ea797225548e37b31c5d8d59c35a35 Mon Sep 17 00:00:00 2001 From: Lior Poterman <191881919+cx-lior-poterman@users.noreply.github.com> Date: Thu, 3 Sep 2026 12:41:23 +0300 Subject: [PATCH] fix(ci): disable automatic dev-release cleanup job in release workflow The deleteDevReleases job's permission gap (workflow granted none while the reusable delete-dev-releases.yml requires id-token/contents/packages write) was already fixed on main in PR #279. This follows up on the decision to drop automatic dev-release cleanup from the release pipeline entirely, matching other Checkmarx plugin release workflows. Job is commented out (not deleted) so it can be restored easily. Cleanup is now done manually via the standalone "Delete dev releases" workflow, and dev releases no longer trigger a second environment approval prompt. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/release.yml | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index be91e4fa..903b49a3 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -37,15 +37,16 @@ concurrency: permissions: {} jobs: - deleteDevReleases: - permissions: - id-token: write # for OIDC token generation - contents: write # for git tag/release deletion - packages: write # for artifact registry cleanup - uses: Checkmarx/ast-eclipse-plugin/.github/workflows/delete-dev-releases.yml@a776dbbfa70cda798753bec14dd7c1f47d094595 - with: - tag: ${{ inputs.rbranch }} - if: inputs.rbranch + # deleteDevReleases job disabled - dev-release cleanup is now done by manually dispatching the "Delete dev releases" workflow. + # deleteDevReleases: + # permissions: + # id-token: write # for OIDC token generation + # contents: write # for git tag/release deletion + # packages: write # for artifact registry cleanup + # uses: Checkmarx/ast-eclipse-plugin/.github/workflows/delete-dev-releases.yml@a776dbbfa70cda798753bec14dd7c1f47d094595 + # with: + # tag: ${{ inputs.rbranch }} + # if: inputs.rbranch release: name: Release environment: release