From 91afd9499b650765e9888e7a3ba001a35503c567 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Dean=20Qui=C3=B1anola?= Date: Thu, 29 Oct 2026 17:03:59 -0700 Subject: [PATCH] ci: request workflows permission for the release token The release-create probe returned 422, so the app token can create releases, yet release-please still fails with "Resource not accessible by integration". GitHub listed contents+workflows as an accepted permission set, and 1.21.1 is the first release since v1.20.1 whose commits change .github/workflows/ (#395). Request workflows: write explicitly: if the app has it, the release goes through; if not, token creation fails and names the missing permission. Removes the probe. --- .github/workflows/release-please.yml | 18 +++++++----------- 1 file changed, 7 insertions(+), 11 deletions(-) diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml index aabb62ff..c987ac8a 100644 --- a/.github/workflows/release-please.yml +++ b/.github/workflows/release-please.yml @@ -33,17 +33,13 @@ jobs: with: app-id: ${{ secrets.RELEASE_APP_ID }} private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }} - - # Temporary: release creation fails with "Resource not accessible by - # integration". An empty POST is always rejected, so it creates nothing: - # 403 means the token lacks a permission (named in - # x-accepted-github-permissions), 422 means the token can write. - - name: Probe release-create permission - env: - GH_TOKEN: ${{ steps.app-token.outputs.token }} - run: | - gh api -i -X POST "repos/${{ github.repository }}/releases" --input /dev/null 2>&1 \ - | grep -iE '^HTTP/|^x-accepted-github-permissions|^x-oauth-scopes|"message"|^gh:' || true + # Listing permissions limits the token to these. workflows is needed + # to tag a release whose commits change .github/workflows/; if the + # app lacks it, token creation fails here with that permission named. + permission-contents: write + permission-issues: write + permission-pull-requests: write + permission-workflows: write - name: Run Release Please uses: google-github-actions/release-please-action@v4