Repository navigation
ci: grant contents:write to dependabot-automerge (fix runtime-denied merge) - #93
Conversation
…merge) The Dependabot auto-merge workflow runs `gh pr merge --auto` (enable auto-merge) and `gh pr review --approve`, but declared only `contents: read`. Enabling and completing auto-merge is a write, so the merge is denied at runtime — the critical finding raised by the Hypatia neurosymbolic scan. Raise the grant to the least privilege the job needs: `contents: write`, keeping `pull-requests: write` and the narrow-scope NB (no secrets:read / id-token:write). Clears one of the pre-existing Hypatia critical findings. The rest (the 6a2 -> descriptiles/ migration tracked as STATE issue #18, etc.) are canon/estate-gated and out of scope here. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01J1XmMC49T8sZ3uUuvrgB7y
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 4 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. |
Codex Review Summary: ❌ FailedThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
Summary
Fixes a real GitHub Actions permissions bug flagged by the Hypatia neurosymbolic scan (one of its pre-existing critical findings): the Dependabot auto-merge workflow runs
gh pr merge --auto(enable auto-merge) andgh pr review --approve, but declares onlycontents: read. Enabling/completing auto-merge is a write, so the merge is denied at runtime.Changes
.github/workflows/dependabot-automerge.yml:permissions.contentsread → write(least privilege for the merge the job performs).pull-requests: writeand the narrow-scope NB (nosecrets: read/id-token: write) are unchanged. One line.RSR Quality Checklist
Required
just/nickelnot installed here.unsafe; no banned functions..envfiles included. Permissions kept least-privilege — onlycontentsraised towrite; nosecrets/id-tokenadded.As Applicable
Testing
contents: write… denied at run time"): enabling auto-merge viagh pr merge --autorequirescontents: write..machine_readable/6a2/ → descriptiles/migration, tracked asSTATE.a2mlissue Migrate .machine_readable to the descriptiles/6a2 layout (blocked: contractiles.mjs needs Node) #18, and related) are canon/estate-gated and out of scope — so this PR alone won't turn the Hypatia check green.Note
This workflow is header-marked "managed by gh actions-lock" (which pins action SHAs). The permissions edit is orthogonal to SHA-locking and should survive regeneration — but flagging in case your lock tooling rewrites the file; if so, the
contents: writevalue needs to be carried in the lock source.Generated by Claude Code