From a7f9019c4a14ac367a35793ea5d7b2a5eae65aa1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Dean=20Qui=C3=B1anola?= Date: Thu, 29 Oct 2026 16:45:13 -0700 Subject: [PATCH] ci: probe release-create permission before release-please The 1.21.1 release fails at release creation with "Resource not accessible by integration" even though the same release app creates releases in other runpod repos. Send an empty POST to the releases API with the app token: a 403 names the missing permission in x-accepted-github-permissions, a 422 means the token can write. The empty body is always rejected, so the probe creates nothing. --- .github/workflows/release-please.yml | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml index 396dd344..aabb62ff 100644 --- a/.github/workflows/release-please.yml +++ b/.github/workflows/release-please.yml @@ -34,6 +34,17 @@ jobs: app-id: ${{ secrets.RELEASE_APP_ID }} private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }} + # Temporary: release creation fails with "Resource not accessible by + # integration". An empty POST is always rejected, so it creates nothing: + # 403 means the token lacks a permission (named in + # x-accepted-github-permissions), 422 means the token can write. + - name: Probe release-create permission + env: + GH_TOKEN: ${{ steps.app-token.outputs.token }} + run: | + gh api -i -X POST "repos/${{ github.repository }}/releases" --input /dev/null 2>&1 \ + | grep -iE '^HTTP/|^x-accepted-github-permissions|^x-oauth-scopes|"message"|^gh:' || true + - name: Run Release Please uses: google-github-actions/release-please-action@v4 id: release