From 52aa7b5c3d4af0b465638940312f13a3b1315f20 Mon Sep 17 00:00:00 2001 From: Samuel K Date: Mon, 18 May 2026 15:01:14 -0500 Subject: [PATCH] fix(ci): remove permission-contents scope restriction from app token step MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The permission-contents:write input restricts the generated token to ONLY that permission, dropping all others the installation has (including metadata:read needed for API calls). Per the docs: "By default, the token inherits all of the installation's permissions" — specifying any permission-* input narrows the scope. Remove it so the token inherits all installation permissions as the working runs did. Also restore token: input on softprops (not env override) and make_latest:true, matching the exact configuration from the runs that succeeded at 17:15/17:27. --- .github/workflows/promote-release.yml | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/.github/workflows/promote-release.yml b/.github/workflows/promote-release.yml index 003d918e1..b7ad31f50 100644 --- a/.github/workflows/promote-release.yml +++ b/.github/workflows/promote-release.yml @@ -22,7 +22,6 @@ jobs: with: app-id: ${{ secrets.DEVSY_GITHUB_APP_ID }} private-key: ${{ secrets.DEVSY_GITHUB_APP_PRIVATE_KEY }} - permission-contents: write - uses: actions/checkout@v6 with: @@ -77,16 +76,15 @@ jobs: - name: create stable release uses: softprops/action-gh-release@v3 - env: - GITHUB_TOKEN: ${{ steps.app-token.outputs.token }} with: + token: ${{ steps.app-token.outputs.token }} tag_name: ${{ steps.version.outputs.stable_tag }} target_commitish: ${{ steps.version.outputs.commit_sha }} name: ${{ steps.version.outputs.stable_tag }} body: ${{ steps.rc_notes.outputs.body }} draft: false prerelease: false - make_latest: "legacy" + make_latest: true - name: trigger full rebuild env: