New JACK autobuild fails on GitHub Actions Pull Requests

[ann0see]

Describe the bug

The JACK build fails on GitHub Actions PRs if Workflow Permissions are set to "Read repository contents and packages permissions". No fail can be seen on PRs by me/if "Read and write permissions" are set.
To Reproduce
#3031 with "Read repository contents and packages permission" set doesn't fail but #3011 does.
This is a successful run while write permissions were enabled: https://github.com/jamulussoftware/jamulus/actions/runs/4515448402/jobs/7952904802

Expected behavior

No matter what permissions are set the JACK build succeeds for GitHub actions and other contributors.

Screenshots

/
Operating system

Windows on GH
Version of Jamulus

/
Additional context

I strongly believe this is a permission error we miss a setting or Autobuild permission somewhere. Something related to GH_TOKEN maybe?

[ann0see]

Currently we have set the permissions to read and write.

[pljones]

Should we make 3.10 dependent upon this or leave until 3.11?

[ann0see]

I think it's not that important to get correct before the next release.

[pljones]

How easy is this to test? Can a list of steps be included to demonstrate failure and success cases?

If we know it's down to a permission issue (e.g. unzip needs write permissions - which is perfectly sane), do we have reason to restrict the permissions? Can we restrict permissions so that only the unzip step has write permission on a specific target directory (e.g. by granting write on that target from a "higher power" / elevated privilege state)?

[ann0see]

As I said above, just change the permissions in the GitHub repository and run two same builds. Once with and once without write permissions. They can be changed here: https://github.com/jamulussoftware/jamulus/settings/actions

Once the build fails, once it goes through. I'm unsure if this is still the case, but I'm currently working on Weblate.

[pljones]

Could that be used to grant the required permission just to the step that needs it? unzip will always need to write...

[ann0see]

Is unzip the problem? Especially I thought write means that we write to the Repo or something on GitHub- not in the runner.

[pljones]

I thought it was the unzip that was failing? Maybe I've missed something.

[ann0see]

I would need to check it again and look at the logs.