From 5a6cb119d4b5146f1874cea801c60a0fdbb6406f Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 14 Aug 2026 16:25:11 +0000 Subject: [PATCH] Fix auto-ready promotion: markPullRequestReadyForReview needs contents: write MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Every promotion attempt since the workflow landed has failed with 'GraphQL: Resource not accessible by integration (markPullRequestReadyForReview)' — the mutation behind `gh pr ready` rejects integration tokens that lack the contents scope, even though it never touches repo contents (see cli/cli#6924). Grant `contents: write` and update the comments that argued for omitting it; the security posture is unchanged, since the workflow still checks out nothing and runs no project code. Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_012Z1dp2xLvcHRdvPBv6vfAy --- .github/workflows/auto-ready.yml | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-) diff --git a/.github/workflows/auto-ready.yml b/.github/workflows/auto-ready.yml index 4e878c48..05a69b00 100644 --- a/.github/workflows/auto-ready.yml +++ b/.github/workflows/auto-ready.yml @@ -13,10 +13,11 @@ # - ci.yml's `ci-green` audit step hand-verifies its own gate; a downstream # promote job there would need an EXEMPT entry and would tangle promotion # into the required check's job graph. -# - the promotion needs `pull-requests: write`; ci.yml is least-privilege -# `contents: read` at the top and PR jobs there run on untrusted-input -# paths. This workflow checks out nothing and runs no project code, so the -# write scope never coexists with anything a PR author controls. +# - the promotion needs `pull-requests: write` and `contents: write` (see +# the permissions block); ci.yml is least-privilege `contents: read` at +# the top and PR jobs there run on untrusted-input paths. This workflow +# checks out nothing and runs no project code, so the write scopes never +# coexist with anything a PR author controls. # - run-level `conclusion == 'success'` is exactly "the whole CI run passed" # (it subsumes `ci-green`; it is marginally stricter — a red report-only # `coverage` job also holds the draft, which is a safe default). @@ -57,9 +58,14 @@ concurrency: cancel-in-progress: true # `pull-requests: write` marks the PR ready (a GraphQL mutation, via `gh pr -# ready`); `actions: write` dispatches the review workflow. Nothing is checked -# out, so no contents scope at all. +# ready`) — but the `markPullRequestReadyForReview` mutation also demands +# `contents: write` from integration tokens (cli/cli#6924); without it the +# call fails with "Resource not accessible by integration" even though nothing +# here reads or writes repo contents. `actions: write` dispatches the review +# workflow. Nothing is checked out and no project code runs, so neither write +# scope ever coexists with anything a PR author controls. permissions: + contents: write pull-requests: write actions: write