Repository navigation
ci: probe release-create permission before release-please - #398
Merged
Merged
Conversation
The 1.21.1 release fails at release creation with "Resource not accessible by integration" even though the same release app creates releases in other runpod repos. Send an empty POST to the releases API with the app token: a 403 names the missing permission in x-accepted-github-permissions, a 422 means the token can write. The empty body is always rejected, so the probe creates nothing.
marie-karpinska
approved these changes
Oct 29, 2026
2 of 3 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The 1.21.1 Release run fails after #397 with a new error:
The token step succeeds and release-please can read the repo, so the IP allow list is no longer the problem. The same release app (org secrets
RELEASE_APP_ID/RELEASE_APP_PRIVATE_KEY) created runpod/host v2.276.4 13 minutes later, so the app still has release permissions in general. release-please doesn't log the failing request, and a debug rerun showed nothing more.Change
Adds one step to the Release job between the token step and release-please. It sends an empty
POST repos/runpod/flash/releaseswith the app token and prints only the status line,x-accepted-github-permissions, and the error message.x-accepted-github-permissions: the token lacks that permission for this repo.GitHub rejects the empty body in both cases, so the probe creates no release or tag. The step never fails the job (
|| true), and release-please runs after it as before.The step only runs on a push to main, so this has to merge before it produces any output. Remove it once the cause is known.
Test plan
make quality-checkpasses locally🤖 Generated with Claude Code