Restore write permission for release-notes check comment - #20200
Closed
T-Gro wants to merge 2 commits into
Closed
Conversation
Posting the bot comment needs pull-requests: write; the token was reduced to read, so createComment failed with 'Resource not accessible by integration' and turned check_release_notes red even when no release notes were required. Restored the write scope and made the comment best-effort so the check reflects the release-notes verdict, not the comment API result. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
github-actions
Bot
added
the
AI-Tooling-Check-Bypassed
The comment is informational only; the verdict is enforced by the shell step. Mark the comment step continue-on-error so an API or action-level failure (e.g. a read-only token) can never turn the check red. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
T-Gro
added a commit
that referenced
this pull request
Aug 4, 2026
…ing the comment non-fatal (#20198) check_release_notes runs via pull_request_target, so GitHub executes the workflow from the default branch (main). Creating the informational PR comment requires pull-requests: write, but #20081 reduced the token to read, turning the check red with HTTP 403 on any PR that had to create (not update) the comment - e.g. Maestro/darc PR #20133. Restore pull-requests: write so the comment posts, and guard the comment step with continue-on-error plus try/catch so posting can never fail the release-notes verdict. Supersedes #20200.
Member
Author
|
Superseded by #20198, which merged the same complete fix (restore \pull-requests: write\ + make the comment step non-fatal via \continue-on-error\ and try/catch). Closing as duplicate. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Posting the
check_release_notesbot comment requirespull-requests: write,but the token was reduced to
read, socreateCommentfailed withResource not accessible by integrationand turned the check red even when norelease notes were required (e.g. the automated dotnet/arcade dependency-update
PRs). Restored the write scope and made the comment step best-effort so the
check reflects the release-notes verdict rather than the comment API result.
Expected check state
check_release_noteson this PR is expected to stay red.pull_request_targetloads its workflow from the default branch, so this PR runs the old workflow
still on
mainand hits the same read-only-token failure before the fix canapply to itself. Subsequent pull request events use the fixed workflow once this
merges.