fix: request Actions capability for auto-pilot create-pr dispatches

[stranske]

Summary

Bounded follow-up to #2869 (merged 81e5821). That PR added actions:write to the auto-pilot-monitor-pr token client so the stall handoff could dispatch a keepalive workflow. Verifying it surfaced the same defect, still unfixed, on a busier path.

The Execute step - Create PR client declares capabilities: ['issues:write', 'contents:read'] but issues four createWorkflowDispatch calls (belt-dispatcher and belt-worker-dispatch). Those capabilities normalize to write-repo/comments/labels/read-repo (token_load_balancer.js:130-144), all of which GITHUB_TOKEN advertises (:68), while GITHUB_TOKEN carries no workflow-dispatch capability at all (:69-70 show only PAT and APP do). The load balancer could therefore select a token that definitively cannot dispatch, and withRetry does not rotate on permission errors, so the dispatch returns 403.

This adds actions:write to that one capability array, matching the shape already used by auto-pilot-capability-check, auto-pilot-redispatch, and now auto-pilot-monitor-pr.

Why this is safe

createTokenAwareRetry initializes currentGithub to the default Actions client and replaces it only when getOptimalToken returns a token (github-api-with-retry.js:572-589). If no workflow-dispatch-capable token is configured — the typical consumer-repo case — selection returns null and the step keeps the default client, which is exactly the pre-change behavior. The change can only narrow selection toward tokens that can actually dispatch; it cannot strand a repo.

Not addressed here, deliberately

Choosing ACTIONS_BOT_PAT over SERVICE_BOT_PAT within the workflow-dispatch-capable set is a separate, repo-wide token_load_balancer.js design property: TOKEN_CAPABILITIES.PAT blanket-advertises workflow-dispatch for every PAT (:69), and none of the four dispatching auto-pilot tasks appear in any TOKEN_SPECIALIZATIONS[*].primaryTasks (:95-128), so taskBonus stays 0 (:805-808) and selection falls back to remaining quota. Fixing that means either routing dispatch calls through a workflow-dispatch specialization or recording real per-PAT scopes — both larger than this change. See the discussion on #2869.

Validation

Both files are byte-identical after the edit (they produced the same git blob b8ffd84), so template drift stays clean.

Summary by CodeRabbit

• Chores
  • Updated automated pull request workflows with permission to manage workflow actions.
  • Applied the same configuration to the consumer repository template for consistent automation behavior.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[coderabbitai]

📝 Walkthrough

Walkthrough

The create-PR retry configuration now requests actions:write in both the main and consumer-repository auto-pilot workflows.

Changes

Workflow permissions

Layer / File(s)	Summary
Create-PR workflow dispatch permission .github/workflows/agents-auto-pilot.yml, templates/consumer-repo/.github/workflows/agents-auto-pilot.yml	Both workflows add actions:write to the create-PR retry configuration. They retain issue and contents access.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Possibly related PRs

• stranske/Workflows#2814: Updates the same workflows for workflow re-dispatch during stall-agent rotation.
• stranske/Workflows#2869: Updates the same workflow files with actions:write for the monitor-pr step.

Suggested labels: github:actions

Suggested reviewers: copilot

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: requesting the Actions capability for auto-pilot create-PR dispatches.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch closer/followup-create-pr-actions-capability

---

_{Comment @coderabbitai help to get the list of available commands.}

[agents-workflows-bot]

Automated Status Summary

Head SHA: b232bb1
Latest Runs: ⏳ pending — Gate
Required contexts: Gate / gate, Health 45 Agents Guard / guard
Required: core tests (3.12): ⏳ pending, core tests (3.13): ⏳ pending, docker smoke: ⏳ pending, gate: ⏳ pending

Workflow / Job	Result	Logs
(no jobs reported)	⏳ pending	—

Coverage Overview

• Coverage history entries: 0

Updated automatically; will refresh on subsequent CI/Docker completions.

---

Keepalive checklist

Scope

No scope information available

Tasks

• No tasks defined

Acceptance criteria

• No acceptance criteria defined

[Copilot]

Pull request overview

This PR fixes auto-pilot “create PR” dispatch reliability by ensuring the token selection logic can choose a client that is actually allowed to call createWorkflowDispatch (i.e., has workflow-dispatch capability via actions:write).

Changes:

• Add actions:write to the capabilities list for the “Execute step - Create PR” token-aware client.
• Mirror the same change in the consumer template workflow to prevent template drift.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
.github/workflows/agents-auto-pilot.yml	Requests actions:write for the create-pr task so dispatch calls won’t be routed to a token lacking workflow-dispatch capability.
templates/consumer-repo/.github/workflows/agents-auto-pilot.yml	Keeps the consumer template byte-aligned with the source workflow by applying the same capability change.

[stranske]

Closer verifier disposition — terminal skipped, no remaining debt

Post-merge Agents Verifier run 30689628830 completed success at 07:27:32Z on merge commit b232bb14, but it did not produce a Provider Comparison Report. It stopped at the Stop when verifier is skipped step with:

No acceptance criteria found in PR or linked issues; skipping verifier.

Terminal disposition written by the run: verdict = skipped, dispatch_outcome = verifier-skipped, policy_action = skip-follow-up. This is expected and correct — #2870 is a closer-authored bounded follow-up with no source issue and no acceptance-criteria block, so the LLM comparison path has nothing to evaluate against. It is not a verifier failure and needs no re-run; re-applying verify:compare would only reproduce the same skip.

Correctness of the change was established before merge rather than by the verifier:

• Both .github/workflows/agents-auto-pilot.yml and templates/consumer-repo/.github/workflows/agents-auto-pilot.yml produced the identical blob b8ffd84, so source/template byte parity holds.
• Required contexts on the head were green: Gate / gate and Health 45 Agents Guard / guard both success.
• Zero unresolved review threads.
• The change can only narrow token selection, never strand a repo: createTokenAwareRetry seeds currentGithub with the default client and swaps only when getOptimalToken returns a token (github-api-with-retry.js:572-589), so a repo with no dispatch-capable PAT falls back to today's exact behavior.

Its predecessor #2869 — the same fix on the monitor-pr path — did get a full comparison run and returned PASS/PASS (openai 97%, anthropic 85%).

Disposition: chain complete. No follow-up PR, no source issue to close, no verifier debt. The one deliberately deferred residual is unchanged and already recorded in this PR's body: preferring ACTIONS_BOT_PAT over SERVICE_BOT_PAT within the dispatch-capable set needs either a workflow-dispatch specialization route or real per-PAT scope recording, and is larger than a capability-array edit.