fix(canary): request permission-workflows:write for tag-move token (unblocks .github promotions)#807
Conversation
The repo-scoped write token was minted with permission-contents:write only, so create-github-app-token restricted it to contents — even after the release-manager App was granted workflows:write. Moving a channel tag on the .github repo (whose HEAD touches .github/workflows/**) requires the workflows permission or GitHub returns 403 'Resource not accessible by integration' via the git-refs API. Request it explicitly so the minted token carries it. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
Note Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughThe canary rollout workflow’s repo-scoped GitHub App token now explicitly requests ChangesCanary rollout permissions
Estimated code review effort: 1 (Trivial) | ~5 minutes Possibly related PRs
Suggested labels: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Dev-Lead — waiting on PR blockers (intent: review-changes)PR: #807 |
|
Note @don-petry I reviewed this PR and no code changes were needed, but it still has blocking checks or reviews (failing or cancelled checks, or changes-requested reviews), so I cannot mark it done yet. I'll re-check automatically. |
|
There was a problem hiding this comment.
Pull request overview
Updates the Canary Rollout workflow’s repo-scoped “tag move” GitHub App token to request workflows: write, addressing GitHub’s permission enforcement when moving channel tags in the .github repository (whose commits routinely touch .github/workflows/**).
Changes:
- Add
permission-workflows: writeto theactions/create-github-app-tokeninputs for the repo-scoped write token. - Document why
workflows: writeis required for channel tag moves in.githuband why it must be explicitly requested at mint time.
Dev-Lead — fix-bot-comment (no-changes)Agent reasoning |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
…s:write) (#812) The canary-rollout header listed the App's perms but omitted Workflows:write, which #807 established is REQUIRED to move channel tags on workflow-heavy repos like .github (else 403 'Resource not accessible by integration'). Spell out the full required-permission set + the grant-AND-request rule (create-github-app-token drops any permission the mint step doesn't list). Also fix the stale ADR line that still named GH_PAT_WORKFLOWS as the mover. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Validated live before merge: dispatched canary-rollout from this branch →
promoted agent-shield/v2-ring0(was 403 'Resource not accessible by integration' on every .github move since ~2026-07-13).Root cause: the repo-scoped write token was minted
permission-contents: writeonly, so create-github-app-token restricted it to contents — even after the release-manager App was grantedworkflows: write. Moving a channel tag on the.githubrepo (whose HEAD touches.github/workflows/**) requires the workflows permission or GitHub returns 403 via the git-refs API (the 'create/update workflow without workflows permission' block). Fix = requestpermission-workflows: writeso the minted token carries it.Refs prior investigation #743/#744/#745/#749; community discussions #26164, #109715.
🤖 Generated with Claude Code
Summary by CodeRabbit