.github/workflows/build-explainers.yml used to auto-commit and git push straight to main. That silently started failing once the "Protect main" branch-protection ruleset began requiring PRs, because github-actions[bot]'s default token isn't in the ruleset's bypass list (only the Admin role is) - see CHANGELOG [2.0.8] for the fix (converted to a check-only gate).
Nothing has audited the other workflows for the same latent pattern. Request: grep .github/workflows/*.yml for any remaining git push (or gh pr merge, direct API writes) targeting main from a job using the default GITHUB_TOKEN, and fix any found the same way before they fail in production.
.github/workflows/build-explainers.ymlused to auto-commit andgit pushstraight tomain. That silently started failing once the "Protect main" branch-protection ruleset began requiring PRs, becausegithub-actions[bot]'s default token isn't in the ruleset's bypass list (only the Admin role is) - see CHANGELOG[2.0.8]for the fix (converted to a check-only gate).Nothing has audited the other workflows for the same latent pattern. Request: grep
.github/workflows/*.ymlfor any remaininggit push(orgh pr merge, direct API writes) targetingmainfrom a job using the defaultGITHUB_TOKEN, and fix any found the same way before they fail in production.