Grant checks:read + statuses:read so the CI gate can read checks on private repos#13
Merged
Merged
Conversation
The CI gate (gated_merge.sh, #12) now reads checks authoritatively from the REST Checks API (commits/{sha}/check-runs) and legacy commit statuses (commits/{sha}/status). The workflow's `permissions:` block did not grant `checks`/`statuses`, and with a permissions block present any unlisted scope defaults to `none`. On a PRIVATE repo those reads then 403, which the gate treats as an unreadable-checks error -- so it fails safe and never merges (observed on realrate/EBA#100: gate looped on `__ERR__` until timeout). Granting both read scopes lets the gate see the PR's checks and merge green patch/minor bumps as intended. Both are read-only. Refs #11. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #12 (Refs #11).
Problem. #12 switched the gate to read checks authoritatively from the REST Checks API (
commits/{sha}/check-runs) plus legacy commit statuses. But the workflow'spermissions:block only grantscontents/pull-requests/issues/models. With a permissions block present, any unlisted scope defaults to none, sochecksandstatuseswerenone. On a private repo those REST reads return 403, which the gate correctly treats as an unreadable-checks error — so it fails safe and never merges.Observed live on
realrate/EBA#100(private): the post-#12 auto-merge run sat in the gate loop retrying__ERR__instead of merging a green patch bump. It never mis-merges (the failure mode is safe), but it won't complete the merge.Fix. Grant
checks: readandstatuses: read(both read-only) in the workflow permissions. The gate can then see the PR's checks and merge green patch/minor bumps as intended. No tooling change.Public repos were unaffected (their checks are world-readable), which is why the earlier public-repo runs merged fine.
🤖 Generated with Claude Code