Fix the invalid Conda Update workflow file (duplicate permissions) - #375
Merged
Merged
Conversation
cron-conda.yml declared top-level permissions twice, once at the head of the file and once between the triggers and the jobs, which YAML forbids: a mapping cannot repeat a key. GitHub rejected the file, so every push created a run that failed immediately with "This run likely failed because of a workflow file issue" and no jobs at all -- including pushes to branches the push filter was meant to exclude, since a file that cannot be parsed cannot be filtered either. The two blocks arrived from #327 and #329, which hardened the same workflow independently. Kept one, and tidied the trailing comma in the branch list.
There was a problem hiding this comment.
🟢 Approval recommended
The change is minimal, restores YAML validity, and preserves the intended permissions model without altering jobs or scopes.
Pull request overview
Fixes a GitHub Actions workflow parsing failure in the “Conda Update” CI workflow by removing a duplicate top-level YAML key, restoring the workflow to a valid, loadable state so triggers and permissions can be applied as intended.
Changes:
- Removed the second (duplicate) top-level
permissions:block that made the workflow invalid YAML. - Tidied the
push.brancheslist by removing the trailing comma ([main, ]→[main]).
File summaries
| File | Description |
|---|---|
.github/workflows/cron-conda.yml |
Removes duplicate top-level permissions and fixes the push branch filter list to restore a valid workflow file. |
Review details
- Files reviewed: 1/1 changed files
- Comments generated: 0
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
This was referenced Sep 15, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Not a draft — this one is a one-line-class fix for CI noise that affects every branch.
Symptom
Conda Updatefails on every push, with no jobs at all and only:Eight such runs in the last day across
fix/pcapng-parser-defects,fix/reassembly-and-e2e-tests,fix/bitfield-flag-constructionandfix/ipv6-extension-advance.Cause
.github/workflows/cron-conda.ymldeclared top-levelpermissions:twice — once at the head of the file (lines 3-4) and again between the triggers andjobs:(lines 12-13). A YAML mapping cannot repeat a key, so GitHub rejects the file outright.That also explains the part that looks contradictory: the workflow declares
on: push: branches: [main, ], yet it ran on pushes tofix/*branches. A file GitHub cannot parse is a file it cannot apply a branch filter from — it registers the event and fails the run. With the file valid again, pushes to non-mainbranches should stop creating runs; that is the one claim here I have not been able to verify in advance, and this PR is what tests it.The duplication came from #327 and #329, which hardened
GITHUB_TOKENscope on this same workflow independently, each adding a block.Change
One
permissions: contents: readblock at the top, which is what theconda-updatejob's owncontents: writeoverride is written against. Trailing comma in the branch list tidied while there.No job, step, trigger or permission scope is changed otherwise — the effective permissions are identical to what the file already intended.