mirror of
https://github.com/abhigyanpatwari/GitNexus.git
synced 2026-09-17 23:52:36 +00:00
48f15a3bca
The default GITHUB_TOKEN cannot be granted `workflows: write`, so
`git push --atomic` of the rc v-tag fails when its commit chain reaches
any commit that modified `.github/workflows/**`. Symptom on the most
recent run:
! [remote rejected] v1.6.4-rc.82 -> v1.6.4-rc.82
(refusing to allow a GitHub App to create or update workflow
`.github/workflows/trivy.yml` without `workflows` permission)
GitHub's rule: any ref-update that makes a workflow-modifying commit
reachable through the new ref requires `workflows: write` on the
identity performing the push, regardless of whether that commit is
already on another remote ref. The default GITHUB_TOKEN cannot hold
that permission.
Pass a fine-grained PAT (RELEASE_PUSH_TOKEN, scoped to this repo with
Contents: write + Workflows: write) into actions/checkout's `token`
input so origin is preauthed for the subsequent `git push`. The
job-level GITHUB_TOKEN keeps its scoped permissions for npm provenance
and other steps.
Required one-time setup:
1. Generate a fine-grained PAT
- Resource owner: account that owns this repo
- Repository access: Only select repositories → GitNexus
- Permissions: Contents: write, Workflows: write, Metadata: read
2. Add as repo secret named RELEASE_PUSH_TOKEN
3. Re-run the failed Release Candidate workflow with force=true
Considered and skipped: GitHub App approach (org-owned, bot identity,
short-lived tokens). Better long-term, but a fine-grained PAT is
acceptable at one-maintainer scale. Migration is mechanical if the
project later wants to switch.
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
||
|---|---|---|
| .. | ||
| actions | ||
| ISSUE_TEMPLATE | ||
| scripts | ||
| workflows | ||
| dependabot.yml | ||
| FUNDING.yml | ||
| PULL_REQUEST_TEMPLATE.md | ||
| release-drafter.yml | ||
| release.yml | ||
| zizmor.yml | ||