ci(repo): skip permissions check for repository_dispatch

[jacekradko]

Summary

• Skip the org membership permissions check for repository_dispatch events in the e2e-staging workflow
• repository_dispatch is already authenticated via a scoped PAT, so the org membership check is redundant and blocks automated triggers from clerk/clerk_go
• Downstream jobs (validate-instances, integration-tests) now tolerate a skipped permissions-check

Test plan

• Trigger e2e-staging via repository_dispatch from clerk/clerk_go and confirm it runs without the permissions failure
• Trigger e2e-staging via workflow_dispatch manually and confirm the permissions check still runs

Summary by CodeRabbit

• Chores
  • Added a placeholder changeset file to record release metadata (no functional changes).
  • Improved CI workflow robustness: allow an early permissions check to be skipped in some triggers, normalize the commit/branch reference used by downstream jobs, and ensure downstream validation and integration steps run when appropriate.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
clerk-js-sandbox	Ready	Preview, Comment	Apr 4, 2026 2:47am

[changeset-bot]

🦋 Changeset detected

Latest commit: e09ad5f

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 0 packages

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[pkg-pr-new]

Open in StackBlitz

@clerk/agent-toolkit

npm i https://pkg.pr.new/@clerk/agent-toolkit@8234

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@8234

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@8234

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@8234

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@8234

@clerk/dev-cli

npm i https://pkg.pr.new/@clerk/dev-cli@8234

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@8234

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@8234

@clerk/express

npm i https://pkg.pr.new/@clerk/express@8234

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@8234

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@8234

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@8234

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@8234

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@8234

@clerk/react

npm i https://pkg.pr.new/@clerk/react@8234

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@8234

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@8234

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@8234

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@8234

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@8234

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@8234

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@8234

commit: e09ad5f

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: ASSERTIVE

Plan: Pro

Run ID: 9e702e8a-0e84-4920-ad12-3ba36e1a034c

📥 Commits

Reviewing files that changed from the base of the PR and between ccbad09 and e09ad5f.

📒 Files selected for processing (1)

• .github/workflows/e2e-staging.yml

---

📝 Walkthrough

Walkthrough

This pull request adds a changeset file and updates the e2e-staging GitHub Actions workflow. The workflow's permissions-check job is now conditionally skipped when triggered via repository_dispatch events. The dependent jobs (validate-instances and integration-tests) are updated with new conditional logic to proceed when permissions-check concludes with either success or skipped status, instead of relying on implicit default success gating.

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: skipping the permissions check when the e2e-staging workflow is triggered via repository_dispatch events.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In @.github/workflows/e2e-staging.yml:
- Line 42: The validate-instances job allows repository_dispatch to reach a
checkout of github.event.client_payload.ref without ref validation; update the
validate-instances job to normalize and validate the incoming ref (same pattern
used by integration-tests) before any checkout or use of secrets: parse
client_payload.ref into a variable, match it against ^(main|release/.*)$ (or the
org-membership gate alternative), and only then perform the actions that check
out that ref and expose
INTEGRATION_INSTANCE_KEYS/INTEGRATION_STAGING_INSTANCE_KEYS; alternatively
reintroduce the org-membership gate for repository_dispatch so
repository_dispatch cannot bypass the existing membership check until the
explicit ref validation is added.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: ASSERTIVE

Plan: Pro

Run ID: 7246f6b1-7dbc-4737-9d08-851c73d0ce92

📥 Commits

Reviewing files that changed from the base of the PR and between f2fe694 and ccbad09.

📒 Files selected for processing (2)

• .changeset/skip-permissions-dispatch.md
• .github/workflows/e2e-staging.yml