fix(ci): remove the invalid workflows permission that killed every sweep - #288
Merged
Conversation
`workflows: write` is not a valid GITHUB_TOKEN permissions key. GitHub refuses to parse the file at all — "Unexpected value 'workflows'" — which silently disabled every trigger: no cron sweep, no workflow_run sweep, no dispatch. Auto-merge was dead from the moment #287 landed (14:08Z) until now. The underlying truth #287 was reaching for: GITHUB_TOKEN has NO scope that permits writing workflow files, so a PR that edits .github/workflows/ can never be merged by the sweep — it reads as MERGEABLE/BLOCKED to the bot and every merge path refuses. That is a platform limit, not a config gap. Such PRs take one `gh pr merge --squash` with a personal token; everything else self-merges. Documented at the permissions block. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What happened
#287 added
workflows: writeto auto-merge.yml's permissions. That key does not exist — GitHub refuses to parse the file:A workflow that fails to parse fires on no trigger at all: no cron, no
workflow_run, no dispatch. Auto-merge has been dead since #287 merged at 14:08Z — the run list confirms zero sweeps in 5 hours on a*/10cron.The truth #287 was reaching for
GITHUB_TOKENhas no scope of any kind that permits writing workflow files. A PR editing.github/workflows/therefore reads asMERGEABLE/BLOCKEDto the bot (per-viewer status) and every merge path —gh pr merge,--auto, REST — refuses. That is a platform limit, not a config gap; no permissions line fixes it.Policy, now documented at the permissions block: workflow-editing PRs take one
gh pr merge --squashwith a personal token; everything else self-merges via the sweep.🤖 Generated with Claude Code