fix(ci): grant pull-requests write so the preview comment can post - #174
Merged
Conversation
The job could list PRs but not comment on one, so every Cloudflare check run failed the workflow with 403 `Resource not accessible by integration`. GitHub answers that request with `x-accepted-github-permissions: issues=write; pull_requests=write` — semicolon, so both grants are required, and I had trimmed pull-requests to read when adapting this from tightknit-app. Same endpoint and same 403 the Cloudflare app itself is almost certainly hitting: its installation carries `pull_requests: write` with no `issues` grant at all. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes the workflow added in #173, which has been failing on every Cloudflare check run since it merged.
What happened
The job resolved the PR fine and then died posting the comment:
Commenting on a PR goes through the issue-comments endpoint, and GitHub requires both grants for it. The semicolon in that header means AND, not OR. I had trimmed
pull-requeststoreadwhen adapting the workflow from tightknit-app, on the reasoning that the job only reads PRs viapulls.list. That is true of the listing call and wrong for the comment call, and the original hadpull-requests: writefor exactly this reason.My dry-run stubbed Octokit, so it exercised the branching and the comment body but never the permission model. That is the gap this fixes.
Incidental confirmation
This is the same endpoint and the same 403 the Cloudflare app itself is almost certainly hitting. Its installation carries
pull_requests: writeand noissuesgrant at all, which is exactly the half-permission shape that produces this error. Worth keeping in mind if anyone wants to restore Cloudflare's own comment rather than rely on this workflow.Verification
The permission model can only really be tested by running it, so the proof is the next Cloudflare build after this merges. Expect the comment on the first PR that builds, and the workflow's failed runs to stop.
🤖 Generated with Claude Code
Need help on this PR? Tag
@codesmith-botwith what you need. Autofix is disabled.