From cb83c568ce292e77b255322266f59689afc9d505 Mon Sep 17 00:00:00 2001
From: Derek Lewis <DerekNonGeneric@inf.is>
Date: Sat, 15 Aug 2026 04:31:42 +0000
Subject: [PATCH] =?UTF-8?q?=F0=9F=8F=97=EF=B8=8F=F0=9F=94=A7=EF=BC=9Aask?=
 =?UTF-8?q?=20REST=20to=20take=20the=20label=20back=20off?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`gh pr edit` and `gh pr comment` reach for GraphQL, which wants
organization permissions that removing a label and leaving a comment do
not need. The app satisfies them today, so this works; tightening its
permissions or installing it somewhere with fewer would break both
silently, since one hides behind a `|| true` and the other only runs
when something has already gone wrong.

The REST endpoints need only the pull request permission the app already
has, and the label one names a single label in the path rather than
trusting a flag to be subtractive. Checked both ways: removing one label
from a pull request carrying two leaves the other alone, and removing a
label that is not there exits non-zero, which is what the `|| true` is
for.

Signed-off-by: Derek Lewis <DerekNonGeneric@inf.is>
Assisted-by: Claude-Code:claude-opus-5
---
 .github/workflows/commit-queue.yml | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/commit-queue.yml b/.github/workflows/commit-queue.yml
index 73cfcb05e..89628fd47 100644
--- a/.github/workflows/commit-queue.yml
+++ b/.github/workflows/commit-queue.yml
@@ -72,12 +72,23 @@ jobs:
       # `unlabeled` is not among the events above, so taking it off cannot
       # start another run. Failing to take it off is not worth failing a run
       # that has already merged, hence the `|| true`.
+      # Both of these go through the REST API rather than `gh pr edit` and
+      # `gh pr comment`, which reach for GraphQL and so want organization
+      # permissions neither task needs. The app happens to satisfy them today;
+      # tightening its permissions, or installing it somewhere with fewer,
+      # would break these silently behind the `|| true`. The endpoints below
+      # need only the pull request permission the app already has, and the
+      # label one names a single label rather than trusting a flag to be
+      # subtractive.
       - name: Take the label back off
         if: always() && steps.token.outcome == 'success'
         env:
           GH_TOKEN: ${{ steps.token.outputs.token }}
           NUMBER: ${{ github.event.pull_request.number }}
-        run: gh pr edit "$NUMBER" --remove-label commit-queue || true
+        run: |
+          gh api --silent -X DELETE \
+            "repos/${GITHUB_REPOSITORY}/issues/${NUMBER}/labels/commit-queue" \
+            || true
 
       - name: Say why it did not land
         if: failure() && steps.token.outcome == 'success'
@@ -86,4 +97,6 @@ jobs:
           NUMBER: ${{ github.event.pull_request.number }}
           RUN: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
         run: |
-          gh pr comment "$NUMBER" --body "The commit queue did not land this. See $RUN — the label has been taken back off, so re-applying it is a deliberate second try."
+          gh api --silent -X POST \
+            "repos/${GITHUB_REPOSITORY}/issues/${NUMBER}/comments" \
+            -f "body=The commit queue did not land this. See ${RUN} — the label has been taken back off, so re-applying it is a deliberate second try."