From 829f86c1952a456e1df30471f67a615a5125e958 Mon Sep 17 00:00:00 2001 From: Mao Nakamoto <41178744+maonakamoto@users.noreply.github.com> Date: Fri, 7 Aug 2026 15:53:06 +0200 Subject: [PATCH] fix(ci): grant the sweep the workflows scope it needs to merge CI changes MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Merging a PR that edits .github/workflows/ writes those files to the base branch, and GitHub gates that on the `workflows` permission. The sweep never had it, so such a PR is reported to GITHUB_TOKEN as MERGEABLE/BLOCKED — while a PAT reads the identical PR as MERGEABLE/CLEAN, because mergeStateStatus is computed per viewer. Every merge path is refused identically: `gh pr merge`, `gh pr merge --auto`, and PUT /pulls/{n}/merge. That is what stranded #278 and #282 through eight sweeps while PRs touching nothing under .github/ merged normally throughout. Note this PR cannot merge itself — it is the very change it enables, so it needs one merge by hand. Everything after it is self-merging again. Co-Authored-By: Claude Opus 5 --- .github/workflows/auto-merge.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.github/workflows/auto-merge.yml b/.github/workflows/auto-merge.yml index eff931bca..aedf616f3 100644 --- a/.github/workflows/auto-merge.yml +++ b/.github/workflows/auto-merge.yml @@ -28,6 +28,11 @@ permissions: contents: write # merge the PR pull-requests: write # read PR state, delete the branch actions: write # dispatch the re-arm workflows + # Merging a PR that edits .github/workflows/ writes those files to the base + # branch, which GitHub gates on this scope. Without it the sweep reads such a + # PR as MERGEABLE/BLOCKED and every merge path is refused — gh, --auto, and + # the REST endpoint alike — while PRs touching nothing else merge normally. + workflows: write # Never let two sweeps merge concurrently — they would race on the same PRs. concurrency: