From c05ff40e1e4c31f58df3e67628e470fcc1488f7b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Sebastian=20Miclu=C8=9Ba-C=C3=A2mpeanu?= Date: Thu, 24 Sep 2026 03:24:37 +0300 Subject: [PATCH] Grant TagBot and Dependabot Auto-merge the token permissions they request This repo's default GITHUB_TOKEN is read-only, so both reusable workflows (SciML/.github/.github/workflows/tagbot.yml, dependabot-automerge.yml) fail at startup: they request scopes the caller doesn't grant. Add a job-level permissions block on TagBot matching what tagbot.yml requests in full, and extend Dependabot Auto-merge's existing block with the two read scopes (checks, statuses) it was missing. Co-Authored-By: Claude Sonnet 5 --- .github/workflows/DependabotAutoMerge.yml | 2 ++ .github/workflows/TagBot.yml | 14 ++++++++++++++ 2 files changed, 16 insertions(+) diff --git a/.github/workflows/DependabotAutoMerge.yml b/.github/workflows/DependabotAutoMerge.yml index 44b814c..10d72c8 100644 --- a/.github/workflows/DependabotAutoMerge.yml +++ b/.github/workflows/DependabotAutoMerge.yml @@ -3,6 +3,8 @@ on: pull_request permissions: contents: write pull-requests: write + checks: read + statuses: read jobs: automerge: uses: "SciML/.github/.github/workflows/dependabot-automerge.yml@v1" diff --git a/.github/workflows/TagBot.yml b/.github/workflows/TagBot.yml index 9ed2d3e..e55aba3 100644 --- a/.github/workflows/TagBot.yml +++ b/.github/workflows/TagBot.yml @@ -5,5 +5,19 @@ on: workflow_dispatch: jobs: tagbot: + # This repository's default GITHUB_TOKEN is read-only; the reusable workflow needs these to run and to tag. + permissions: + actions: read + checks: read + contents: write + deployments: read + issues: read + discussions: read + packages: read + pages: read + pull-requests: read + repository-projects: read + security-events: read + statuses: read uses: "SciML/.github/.github/workflows/tagbot.yml@v1" secrets: "inherit"