Permissions in reusable workflows!

Below is a "calling" workflow. Notice the Job-based permissions
We always need to pass necessary permissions to the reusable workflow
The reusable "called" workflow gets the calling "context", including GITHUB_TOKEN and these perms
ProTip: Also set required perms in Reusable Workflow. Then, it’ll fail earily if calling doesn’t give them

name: Docker Build
on:
push:
  branches:
    - main
  pull_request:
jobs:
  call-docker-build:
    name: Call Docker Build
    uses: mostlydevops/actions/.github/workflows/reusable-docker-build.yaml@main
    permissions:
      packages: write
      pull-requests: write
    with:
      image-name: ghcr.io/mostlydevops/wordsmith-web

Homework

Move to Reusable Workflow for Docker Build

We need to evolve our Docker Build

In your actions repo
1. We’ll use my advanced docker-build-workflow template
2. In your actions repo, create a new file .github/workflows/reusable-docker-build.yml
3. Copy the contents of this file and commit to main branch
  1. (Since no repo is calling it yet, we’ll shortcut the PR testing process)
In your wordsmith-web and wordsmith-api repos, replace the workflow
1. Delete the old workflow file .github/workflows/docker-build.yml
2. Create a new file .github/workflows/call-docker-build.yml and add this content
3. Change line 30 uses: to point to your new reusable workflow file
4. Commit that to a PR branch and watch the Action run in a wordsmith-web PR
5. You may have minor issues. Check errors. Check Actions tab (troubleshooting required)
6. Once it checks green, merge the PR and add the same calling workflow to wordsmith-api