fix(ci): keep checks/statuses scopes when copying auto-merge to a private repo - #6
Merged
Conversation
…vate repo This workflow is the copy source for ~20 repos. It omitted checks:read and statuses:read, which a public repo does not need to answer the sweep's statusCheckRollup query — so it worked everywhere it was tried, and every place it was tried was public. ivy-portal, the first private repo to run it, failed on every sweep with 'Resource not accessible by integration' and merged nothing, ever.
This was referenced Aug 7, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The class
This file is the copy source for the auto-merge workflow now running in ~20 repos. It omits
checks: readandstatuses: read.A public repo answers the sweep's
statusCheckRollupquery without those scopes. So the workflow worked in every repo it was ever tried in — and every one of those was public. The scopes looked unnecessary because nothing had exercised the path that needs them.ivy-portalis the first private repo to run it. There, every sweep since the workflow landed has failed:It has merged nothing, ever. Repo-level fix: bitbaum/ivy-portal#4.
Why fix the template too
Otherwise the next private repo that copies this file inherits the same silent break. The failure mode is what makes it worth a comment in the file: a repo that merges nothing looks exactly like a repo with nothing ready to merge, so nobody goes looking.
Adding two read scopes is a no-op on the public repos already running this.
Found while clearing damage from the 2026-08-06 GitHub Actions outage.
🤖 Generated with Claude Code