fix(ci): remove permission-contents scope restriction from app token#359
Conversation
…step The permission-contents:write input restricts the generated token to ONLY that permission, dropping all others the installation has (including metadata:read needed for API calls). Per the docs: "By default, the token inherits all of the installation's permissions" — specifying any permission-* input narrows the scope. Remove it so the token inherits all installation permissions as the working runs did. Also restore token: input on softprops (not env override) and make_latest:true, matching the exact configuration from the runs that succeeded at 17:15/17:27.
✅ Deploy Preview for devsydev canceled.
|
|
Warning Rate limit exceeded
You’ve run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
1 participant
Summary
actions/create-github-app-token@v3docs: "By default, the token inherits all of the installation's permissions." When anypermission-*input is specified, the token is restricted to only those permissions — all others are dropped.permission-contents: write, which inadvertently stripped all other permissions from the token (e.g.metadata: readneeded for API calls), causingsoftprops/action-gh-releaseto receive a narrowly-scoped token that couldn't create releases.permission-contents: writeso the token inherits all installation permissions (contents: write, metadata: read, pull_requests: write) — exactly matching the working configuration from runs 26048757691 and 26049369190.token:input on softprops (not env override) andmake_latest: true, matching the proven working state.fetch RC release notes.