From 8ac4020b85f363cac462d3735f215ae59d660a1f Mon Sep 17 00:00:00 2001 From: Don Petry <36422719+don-petry@users.noreply.github.com> Date: Sun, 19 Jul 2026 16:35:05 -0500 Subject: [PATCH] fix(canary): request permission-workflows:write for the tag-move token MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The repo-scoped write token was minted with permission-contents:write only, so create-github-app-token restricted it to contents — even after the release-manager App was granted workflows:write. Moving a channel tag on the .github repo (whose HEAD touches .github/workflows/**) requires the workflows permission or GitHub returns 403 'Resource not accessible by integration' via the git-refs API. Request it explicitly so the minted token carries it. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/canary-rollout.yml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.github/workflows/canary-rollout.yml b/.github/workflows/canary-rollout.yml index 97d7c8793..20da542d2 100644 --- a/.github/workflows/canary-rollout.yml +++ b/.github/workflows/canary-rollout.yml @@ -150,6 +150,13 @@ jobs: .github .github-private permission-contents: write + # workflows:write is REQUIRED to move a channel tag on a repo whose HEAD touches + # .github/workflows/** — GitHub refuses an App without it ("Resource not accessible + # by integration", surfacing the "create/update workflow without workflows permission" + # block via the git-refs API). The `.github` repo is all reusable workflows, so every + # promotion there tripped it. `create-github-app-token` restricts the token to the + # permissions requested here, so this MUST be listed even though the App now grants it. + permission-workflows: write - name: Checkout (with tags) uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0