From d4cad39d69cc40459de3cfd2a51b47f481024294 Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 10 Nov 2026 13:59:04 +0000 Subject: [PATCH] ci: grant contents:write to dependabot-automerge (fix runtime-denied merge) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The Dependabot auto-merge workflow runs `gh pr merge --auto` (enable auto-merge) and `gh pr review --approve`, but declared only `contents: read`. Enabling and completing auto-merge is a write, so the merge is denied at runtime — the critical finding raised by the Hypatia neurosymbolic scan. Raise the grant to the least privilege the job needs: `contents: write`, keeping `pull-requests: write` and the narrow-scope NB (no secrets:read / id-token:write). Clears one of the pre-existing Hypatia critical findings. The rest (the 6a2 -> descriptiles/ migration tracked as STATE issue #18, etc.) are canon/estate-gated and out of scope here. Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_01J1XmMC49T8sZ3uUuvrgB7y --- .github/workflows/dependabot-automerge.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml index d064cf0..bb4b786 100644 --- a/.github/workflows/dependabot-automerge.yml +++ b/.github/workflows/dependabot-automerge.yml @@ -45,7 +45,7 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: false permissions: - contents: read # needed to enable auto-merge + contents: write # needed to enable AND complete auto-merge (the merge is a write; contents:read is denied at runtime) pull-requests: write # needed to approve # NB: keep narrow — do NOT add secrets: read or id-token: write here. jobs: