From 2ed14a93b8bd0e91e05191241897ad0b11021902 Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 10 Nov 2026 13:58:47 +0000 Subject: [PATCH] ci: grant contents:write to dependabot-automerge (fix runtime-denied merge) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The Dependabot auto-merge workflow runs `gh pr merge --auto` (enable auto-merge) and `gh pr review --approve`, but declared only `contents: read`. Enabling and completing auto-merge is a write, so the merge is denied at runtime — the critical finding raised by the Hypatia neurosymbolic scan. Raise the grant to the least privilege the job needs: `contents: write`, keeping `pull-requests: write` and the narrow-scope NB (no secrets:read / id-token:write). Clears one of the pre-existing Hypatia critical findings. The rest (the 6a2 -> descriptiles/ migration, etc.) are canon/estate-gated and tracked separately — out of scope here. Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_01J1XmMC49T8sZ3uUuvrgB7y --- .github/workflows/dependabot-automerge.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml index 93ba134..a998ec0 100644 --- a/.github/workflows/dependabot-automerge.yml +++ b/.github/workflows/dependabot-automerge.yml @@ -42,7 +42,7 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: false permissions: - contents: read # needed to enable auto-merge + contents: write # needed to enable AND complete auto-merge (the merge is a write; contents:read is denied at runtime) pull-requests: write # needed to approve # NB: keep narrow — do NOT add secrets: read or id-token: write here. jobs: