From e1079a37b358e5340dc2704f7851157dd84b6012 Mon Sep 17 00:00:00 2001 From: Bibek Chaudhary Date: Wed, 15 Jul 2026 13:56:53 +0545 Subject: [PATCH] Grant checks:read + statuses:read to the auto-merge workflow The CI gate (gated_merge.sh, #12) now reads checks authoritatively from the REST Checks API (commits/{sha}/check-runs) and legacy commit statuses (commits/{sha}/status). The workflow's `permissions:` block did not grant `checks`/`statuses`, and with a permissions block present any unlisted scope defaults to `none`. On a PRIVATE repo those reads then 403, which the gate treats as an unreadable-checks error -- so it fails safe and never merges (observed on realrate/EBA#100: gate looped on `__ERR__` until timeout). Granting both read scopes lets the gate see the PR's checks and merge green patch/minor bumps as intended. Both are read-only. Refs #11. Co-Authored-By: Claude Opus 4.8 --- .github/workflows/dependabot-automerge.yaml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/.github/workflows/dependabot-automerge.yaml b/.github/workflows/dependabot-automerge.yaml index 9ddc91c..2a67f11 100644 --- a/.github/workflows/dependabot-automerge.yaml +++ b/.github/workflows/dependabot-automerge.yaml @@ -39,6 +39,14 @@ permissions: pull-requests: write issues: write models: read # GitHub Models inference for the major-bump AI risk gate + # gated_merge.sh reads the CI gate authoritatively from the REST Checks API + # (commits/{sha}/check-runs) plus legacy commit statuses (commits/{sha}/status). + # On a private repo a token without these read scopes gets 403 -- which the + # gate treats as an unreadable-checks error and, failing safe, never merges. + # With a `permissions:` block present, any scope not listed defaults to `none`, + # so both must be granted explicitly (realrate/.github#11). + checks: read + statuses: read jobs: auto-merge: