From dee99170e93897a80307ef798c1c1ef0796bb091 Mon Sep 17 00:00:00 2001 From: Mao Nakamoto <41178744+maonakamoto@users.noreply.github.com> Date: Fri, 7 Aug 2026 21:10:27 +0200 Subject: [PATCH] fix(ci): remove the invalid workflows permission that killed every sweep MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `workflows: write` is not a valid GITHUB_TOKEN permissions key. GitHub refuses to parse the file at all — "Unexpected value 'workflows'" — which silently disabled every trigger: no cron sweep, no workflow_run sweep, no dispatch. Auto-merge was dead from the moment #287 landed (14:08Z) until now. The underlying truth #287 was reaching for: GITHUB_TOKEN has NO scope that permits writing workflow files, so a PR that edits .github/workflows/ can never be merged by the sweep — it reads as MERGEABLE/BLOCKED to the bot and every merge path refuses. That is a platform limit, not a config gap. Such PRs take one `gh pr merge --squash` with a personal token; everything else self-merges. Documented at the permissions block. Co-Authored-By: Claude Fable 5 --- .github/workflows/auto-merge.yml | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/.github/workflows/auto-merge.yml b/.github/workflows/auto-merge.yml index aedf616f3..79e27428d 100644 --- a/.github/workflows/auto-merge.yml +++ b/.github/workflows/auto-merge.yml @@ -28,11 +28,15 @@ permissions: contents: write # merge the PR pull-requests: write # read PR state, delete the branch actions: write # dispatch the re-arm workflows - # Merging a PR that edits .github/workflows/ writes those files to the base - # branch, which GitHub gates on this scope. Without it the sweep reads such a - # PR as MERGEABLE/BLOCKED and every merge path is refused — gh, --auto, and - # the REST endpoint alike — while PRs touching nothing else merge normally. - workflows: write + +# KNOWN LIMIT — PRs that edit .github/workflows/ cannot be merged by this +# sweep. GITHUB_TOKEN has no workflow-writing scope AT ALL: `workflows: write` +# is not a valid permissions key (adding it makes this file unparseable and +# silently kills every trigger — that exact mistake shipped as #287 and took +# the sweep down for 5 hours). To GITHUB_TOKEN such a PR reads as +# MERGEABLE/BLOCKED and gh, --auto, and the REST endpoint all refuse it. +# Those PRs need a merge with a personal token (`gh pr merge --squash` as a +# user); everything else self-merges here. # Never let two sweeps merge concurrently — they would race on the same PRs. concurrency: