From 1b02e35be260c843dc831146af8c6cc058b7985b Mon Sep 17 00:00:00 2001 From: Stephen Date: Tue, 4 Aug 2026 10:40:30 -0700 Subject: [PATCH] fix(ci): grant pull-requests write so the preview comment can post MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The job could list PRs but not comment on one, so every Cloudflare check run failed the workflow with 403 `Resource not accessible by integration`. GitHub answers that request with `x-accepted-github-permissions: issues=write; pull_requests=write` — semicolon, so both grants are required, and I had trimmed pull-requests to read when adapting this from tightknit-app. Same endpoint and same 403 the Cloudflare app itself is almost certainly hitting: its installation carries `pull_requests: write` with no `issues` grant at all. Co-Authored-By: Claude Opus 5 --- .github/workflows/cf-preview-url.yml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/.github/workflows/cf-preview-url.yml b/.github/workflows/cf-preview-url.yml index e930da3..bf0f651 100644 --- a/.github/workflows/cf-preview-url.yml +++ b/.github/workflows/cf-preview-url.yml @@ -23,7 +23,11 @@ jobs: concurrency: group: cf-preview-url-${{ github.event.check_run.check_suite.head_branch }} permissions: - pull-requests: read + # Commenting on a PR goes through the issue-comments endpoint, which + # requires BOTH grants: it answers 403 with + # `x-accepted-github-permissions: issues=write; pull_requests=write`. + # `pull-requests: read` is enough to list PRs but not to comment on one. + pull-requests: write issues: write steps: