fix(ci): grant the sweep the workflows scope it needs to merge CI changes - #287
Merged
Conversation
…nges
Merging a PR that edits .github/workflows/ writes those files to the base
branch, and GitHub gates that on the `workflows` permission. The sweep never
had it, so such a PR is reported to GITHUB_TOKEN as MERGEABLE/BLOCKED — while
a PAT reads the identical PR as MERGEABLE/CLEAN, because mergeStateStatus is
computed per viewer.
Every merge path is refused identically: `gh pr merge`, `gh pr merge --auto`,
and PUT /pulls/{n}/merge. That is what stranded #278 and #282 through eight
sweeps while PRs touching nothing under .github/ merged normally throughout.
Note this PR cannot merge itself — it is the very change it enables, so it
needs one merge by hand. Everything after it is self-merging again.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
catomean
added a commit
that referenced
this pull request
Aug 7, 2026
…eep (#288) `workflows: write` is not a valid GITHUB_TOKEN permissions key. GitHub refuses to parse the file at all — "Unexpected value 'workflows'" — which silently disabled every trigger: no cron sweep, no workflow_run sweep, no dispatch. Auto-merge was dead from the moment #287 landed (14:08Z) until now. The underlying truth #287 was reaching for: GITHUB_TOKEN has NO scope that permits writing workflow files, so a PR that edits .github/workflows/ can never be merged by the sweep — it reads as MERGEABLE/BLOCKED to the bot and every merge path refuses. That is a platform limit, not a config gap. Such PRs take one `gh pr merge --squash` with a personal token; everything else self-merges. Documented at the permissions block. Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this fixes
The auto-merge sweep cannot merge any PR that edits
.github/workflows/.Merging such a PR writes workflow files to the base branch, and GitHub gates
that on the
workflowspermission — whichauto-merge.ymlnever granted. Thesymptom is indirect and misleading:
GITHUB_TOKENis told the PR iswhile a PAT reads the same PR at the same moment as
MERGEABLE/**CLEAN**,because
mergeStateStatusis computed per viewer.Every merge path is refused identically —
gh pr merge,gh pr merge --auto(#283), and
PUT /pulls/{n}/merge(#286). Ruled out along the way:mainBlast radius
#278 and #282 have been green and unmergeable through eight sweeps. Both fix
CI itself, so both are in exactly the class this blocks.
It is the change that grants the permission, so it needs one merge by
hand. After that the queue is self-draining again — including #278 and #282.
🤖 Generated with Claude Code