Reusable workflow permissions

[crazy-max]

Current users need to set the exact same set of permissions used in our reusable workflows when calling it: https://github.com/docker/github-builder-experimental/blob/8e86ef337e3bb69616d52def17e764a14a827ef8/.github/workflows/build.yml#L143-L146

Like: https://github.com/tonistiigi/xx/pull/217/files#diff-5c3fa597431eda03ac3339ae6bf7f05e1a50d6fc7333679ec38e21b337cb6721R138-R141

That's because GitHub Actions currently does not allow a reusable workflow to raise its own permissions above what the caller provides then the caller must provide permissions ≥ these, otherwise the workflow is blocked for security reasons.

In our case we only want:

    permissions:
      contents: read 
      id-token: write

The packages: write permissions is only necessary if user wants to push to GHCR.

It seems the only way to avoid this is to move the packages: write permission to the step requiring it and duplicate this one if user doesn't push to ghcr.

[crazy-max]

Tried to remove packages: write in tonistiigi/xx@1b2d899#diff-5c3fa597431eda03ac3339ae6bf7f05e1a50d6fc7333679ec38e21b337cb6721L141

But then workflow fails with: https://github.com/tonistiigi/xx/actions/runs/19368897719

Invalid workflow file: .github/workflows/build.yml#L136
The workflow is not valid. .github/workflows/build.yml (Line: 136, Col: 3): Error calling workflow 'docker/github-builder-experimental/.github/workflows/bake.yml@main'. The nested job 'build' is requesting 'packages: write', but is only allowed 'packages: none'.

Same if I set packages: read: https://github.com/tonistiigi/xx/actions/runs/19368954272

Invalid workflow file: .github/workflows/build.yml#L136
The workflow is not valid. .github/workflows/build.yml (Line: 136, Col: 3): Error calling workflow 'docker/github-builder-experimental/.github/workflows/bake.yml@main'. The nested job 'build' is requesting 'packages: write', but is only allowed 'packages: read'.

Seems to make sense looking at their docs https://docs.github.com/en/actions/reference/workflows-and-actions/reusing-workflow-configurations#supported-keywords-for-jobs-that-call-a-reusable-workflow

But for nested reusable workflows this is supported https://docs.github.com/en/actions/reference/workflows-and-actions/reusing-workflow-configurations#access-and-permissions-for-nested-workflows

GITHUB_TOKEN permissions can only be the same or more restrictive in nested workflows. For example, in the workflow chain A > B > C, if workflow A has package: read token permission, then B and C cannot have package: write permission.

That's such a terrible UX...

Also tried to move permissions to the build step as this is the only one pushing to the registry but this is not supported.

[crazy-max]

Also tried to remove packages write permissions in our reusable workflow and let caller upgrade them: https://github.com/docker/github-builder-experimental/compare/perms-minimal?expand=1

But fails: https://github.com/docker/github-builder-experimental/actions/runs/19369593205/job/55421648020#step:7:315

#20 pushing layers
#20 pushing layers 0.4s done
#20 ERROR: failed to push ghcr.io/docker/github-builder-test: denied: installation not allowed to Write organization package