Repository navigation
Grant TagBot and Dependabot Auto-merge the token permissions they request - #125
Merged
ChrisRackauckas merged 1 commit intoSep 24, 2026
Merged
Conversation
…uest This repo's default GITHUB_TOKEN is read-only, so both reusable workflows (SciML/.github/.github/workflows/tagbot.yml, dependabot-automerge.yml) fail at startup: they request scopes the caller doesn't grant. Add a job-level permissions block on TagBot matching what tagbot.yml requests in full, and extend Dependabot Auto-merge's existing block with the two read scopes (checks, statuses) it was missing. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This repo's default
GITHUB_TOKENis read-only, so both reusable workflows(
SciML/.github/.github/workflows/tagbot.yml,dependabot-automerge.yml) end instartup_failure: they request scopes the caller job doesn't grant.Documentation.ymlalready carries this fix; this does the same for TagBot and Dependabot Auto-merge.
TagBot.yml: had nopermissions:block at all — added one matching everythingtagbot.ymlrequests (contents: writeplus the 11 read scopes it declares).DependabotAutoMerge.yml: already had a partial block (contents,pull-requestswrite) — added the two read scopes (
checks,statuses)dependabot-automerge.ymlalso requests, which were silently downgraded to
noneby the existing explicit block.Tested:
actionlintclean on both files.Registered versions with no corresponding tag (TagBot couldn't run to create them):
v0.3.3,v0.3.4,v0.3.5,v0.3.6,v0.4.0,v0.4.1,v0.4.2,v0.4.3— shouldtag themselves once this merges and TagBot's
workflow_dispatch(or the next registrycomment) runs.
🤖 Generated with Claude Code · model: claude-sonnet-5
Review: unreviewed