From d82339501f537147a35eaa01bbd453057b784537 Mon Sep 17 00:00:00 2001
From: G <41178744+maonakamoto@users.noreply.github.com>
Date: Fri, 7 Aug 2026 08:51:30 +0200
Subject: [PATCH] fix(ci): keep checks/statuses scopes when copying auto-merge
 to a private repo
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This workflow is the copy source for ~20 repos. It omitted checks:read and
statuses:read, which a public repo does not need to answer the sweep's
statusCheckRollup query — so it worked everywhere it was tried, and every
place it was tried was public.

ivy-portal, the first private repo to run it, failed on every sweep with
'Resource not accessible by integration' and merged nothing, ever.
---
 .github/workflows/auto-merge.yml | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/.github/workflows/auto-merge.yml b/.github/workflows/auto-merge.yml
index 4cab138..27005f1 100644
--- a/.github/workflows/auto-merge.yml
+++ b/.github/workflows/auto-merge.yml
@@ -28,6 +28,18 @@ permissions:
   contents: write # merge the PR
   pull-requests: write # read PR state, delete the branch
   actions: write # dispatch the re-arm workflows
+  # Only load-bearing on a PRIVATE repo — which is exactly why this was missing
+  # for so long. The sweep asks for statusCheckRollup to decide whether a PR is
+  # green; a public repo answers that with no explicit scope, so this file was
+  # copied into ~20 repos and worked in every one of them. The first private
+  # repo to run it (ivy-portal) failed on every single sweep with
+  #   GraphQL: Resource not accessible by integration
+  #     (repository.pullRequests.nodes.0.statusCheckRollup...)
+  # and merged nothing, ever. Keep these two lines when copying this file: a
+  # repo that merges nothing is indistinguishable from a repo with nothing to
+  # merge, so the next occurrence would also go unnoticed.
+  checks: read # check-run conclusions (CI jobs)
+  statuses: read # commit statuses (external reporters)
 
 # Never let two sweeps merge concurrently — they would race on the same PRs.
 concurrency: