What: the first-ever real dispatch of promote.yml (2026-07-20, alpha_tag=v0.0.3-alpha.4) failed in "Validate the alpha and derive the clean tag": gh: Resource not accessible by integration (HTTP 403). The workflow declares permissions: contents: write, actions: write, which zeroes all other scopes — so the check-runs API call behind the every-check-green guard is forbidden. The guard fails closed (good) but blocks every promote (bad).
Fix: add checks: read to the permissions block (one line). Consider a workflow-lint test asserting the scopes promote's script actually calls.
Workaround used for v0.0.3: manual clean-tag push at the alpha's exact SHA after hand-verifying the guard's conditions (green CI on the SHA, no existing clean tag, manifest/tag agreement) — release.yml then published normally (publish-marketplace: success). The front door should work next time.
🤖 Generated with Claude Code
What: the first-ever real dispatch of promote.yml (2026-07-20,
alpha_tag=v0.0.3-alpha.4) failed in "Validate the alpha and derive the clean tag":gh: Resource not accessible by integration (HTTP 403). The workflow declarespermissions: contents: write, actions: write, which zeroes all other scopes — so the check-runs API call behind the every-check-green guard is forbidden. The guard fails closed (good) but blocks every promote (bad).Fix: add
checks: readto the permissions block (one line). Consider a workflow-lint test asserting the scopes promote's script actually calls.Workaround used for v0.0.3: manual clean-tag push at the alpha's exact SHA after hand-verifying the guard's conditions (green CI on the SHA, no existing clean tag, manifest/tag agreement) — release.yml then published normally (publish-marketplace: success). The front door should work next time.
🤖 Generated with Claude Code