Move the Release Task's Job Scopes to the Caller

[ptr727]

What

build-release-task.yml no longer declares job-level permissions: on build-nuget (id-token: write) or github-release (contents: write, actions: write). The caller grants what the targets it enables need, and docs/reusable-workflows.md "Adopting the Release Chain" says so.

Why

The hub's first release through the task, dispatched on main at 82fecef after #768, ended in startup_failure (run 31972504539). A called job's permissions: block is validated against the caller's grant before its if: runs (GOVERNANCE.md "Workflow YAML Conventions", the reusable-workflows bullet), so build-nuget asking for id-token: write fails any caller that does not grant it, the hub's own publish job included, even though the job is disabled. github-release's block has the same shape and would fail every smoke build, since a Dependabot pull request holds a read-only token that cannot grant contents: write. This is the finding #762 declined on the ground that only NuGet/login consumes the scope: the consumption was never the problem, the declaration was.

Verification

actionlint, prose gate, audit self-test, 686 unit tests, markdownlint. The live proof is the re-dispatched hub release after this promotes, which is the next step.

[Copilot]

Pull request overview

This PR updates the hub’s reusable release workflow to avoid startup failures caused by job-level permissions: blocks that are validated against the caller’s token grant even when the job is skipped. It shifts responsibility for granting write/OIDC scopes to the caller workflow and documents the required caller-side permissions.

Changes:

• Remove job-level permissions: from build-nuget and github-release in build-release-task.yml.
• Expand docs/reusable-workflows.md guidance so adopters grant the needed permissions at the caller job level.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
docs/reusable-workflows.md	Documents caller-granted permissions for release-chain adoption.
.github/workflows/build-release-task.yml	Removes job-level permissions to prevent reusable-workflow startup validation failures.

Suppressed comments (1)

.github/workflows/build-release-task.yml:536

• This comment implies contents: write and actions: write are needed for any publish, but they are only required when this job is enabled (inputs.github is true and inputs.smoke is false). Making that explicit helps callers avoid granting write scopes when they do not create a GitHub release.

    # The release upload and the artifact-delete cleanup both write with GITHUB_TOKEN, and the caller grants contents: write and actions: write on a publish.
    # No job-level permissions: block here, for the reason build-nuget gives: a block is validated against the caller's grant before if: runs, and a smoke caller holds a read-only token.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[ptr727]

Answering the suppressed finding, "Suppressed comments (1)", from the round on 4daf37b: .github/workflows/build-release-task.yml:536, "This comment implies contents: write and actions: write are needed for any publish, but they are only required when this job is enabled". Fixed in a244452: the comment says the caller grants them when it sets github: true on a non-smoke run, and that a registry-only or smoke caller leaves the job disabled and grants neither.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.