mirror of
https://github.com/abhigyanpatwari/GitNexus.git
synced 2026-10-29 06:32:28 +00:00
48f15a3bca
The default GITHUB_TOKEN cannot be granted `workflows: write`, so
`git push --atomic` of the rc v-tag fails when its commit chain reaches
any commit that modified `.github/workflows/**`. Symptom on the most
recent run:
! [remote rejected] v1.6.4-rc.82 -> v1.6.4-rc.82
(refusing to allow a GitHub App to create or update workflow
`.github/workflows/trivy.yml` without `workflows` permission)
GitHub's rule: any ref-update that makes a workflow-modifying commit
reachable through the new ref requires `workflows: write` on the
identity performing the push, regardless of whether that commit is
already on another remote ref. The default GITHUB_TOKEN cannot hold
that permission.
Pass a fine-grained PAT (RELEASE_PUSH_TOKEN, scoped to this repo with
Contents: write + Workflows: write) into actions/checkout's `token`
input so origin is preauthed for the subsequent `git push`. The
job-level GITHUB_TOKEN keeps its scoped permissions for npm provenance
and other steps.
Required one-time setup:
1. Generate a fine-grained PAT
- Resource owner: account that owns this repo
- Repository access: Only select repositories → GitNexus
- Permissions: Contents: write, Workflows: write, Metadata: read
2. Add as repo secret named RELEASE_PUSH_TOKEN
3. Re-run the failed Release Candidate workflow with force=true
Considered and skipped: GitHub App approach (org-owned, bot identity,
short-lived tokens). Better long-term, but a fine-grained PAT is
acceptable at one-maintainer scale. Migration is mechanical if the
project later wants to switch.
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
||
|---|---|---|
| .. | ||
| ci-e2e.yml | ||
| ci-quality.yml | ||
| ci-report.yml | ||
| ci-scope-parity.yml | ||
| ci-tests.yml | ||
| ci.yml | ||
| claude.yml | ||
| codeql.yml | ||
| dependency-review.yml | ||
| docker.yml | ||
| gitleaks.yml | ||
| pr-description-check.yml | ||
| pr-labeler.yml | ||
| publish.yml | ||
| release-candidate.yml | ||
| scorecard.yml | ||
| tree-sitter-upgrade-readiness.yml | ||
| triage-sweep.yml | ||
| trivy.yml | ||
| workflow-lint.yml | ||