From 4ff80704793d4645a23f43a48232440fc3026535 Mon Sep 17 00:00:00 2001 From: Jeremy Daer Date: Mon, 27 Jul 2026 15:07:53 -0700 Subject: [PATCH] ci: contents write so the job token can arm auto-merge MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Exercise round 3 passed every invariant (repair PR adopted, head/author verified after the API-catchup retry) and failed only on enablePullRequestAutoMerge: Resource not accessible by integration. Arming auto-merge is a contents operation — the same grant the dependabot-auto-merge workflows carry. The token still cannot push workflow files; the repair branch push stays on the deploy key. --- .github/workflows/dependabot-sync-actions-comments.yml | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/.github/workflows/dependabot-sync-actions-comments.yml b/.github/workflows/dependabot-sync-actions-comments.yml index de56253..ba27a4c 100644 --- a/.github/workflows/dependabot-sync-actions-comments.yml +++ b/.github/workflows/dependabot-sync-actions-comments.yml @@ -34,7 +34,7 @@ name: Sync Dependabot action pin comments # sync: # uses: basecamp/.github/.github/workflows/dependabot-sync-actions-comments.yml@ # with: {default-branch: } -# permissions: {contents: read, actions: write, pull-requests: write} +# permissions: {contents: write, actions: write, pull-requests: write} # secrets: inherit # plus the `dependabot-sync` environment (deployment branches: default # branch only) holding SYNC_ACTIONS_DEPLOY_KEY, and the repository setting @@ -74,7 +74,11 @@ jobs: # branch policy enforces the same server-side. if: github.ref == format('refs/heads/{0}', inputs.default-branch) permissions: - contents: read # fetch the repo over https; the push itself uses the deploy key + # contents: write is for enablePullRequestAutoMerge only (merging is a + # contents operation — same grant the dependabot-auto-merge workflows + # carry). The token still cannot push workflow files (App-token + # restriction); the repair branch push uses the deploy key. + contents: write actions: write # approve held runs on the repair PR so required checks attach pull-requests: write # create/update the repair PR and enable auto-merge env: