Merged
Conversation
The sync-skills job requested pull-requests:write and issues:write on the skills repo token, but the GitHub App installation only grants contents:write. Remove the excess permissions. Move failure notification to use github.token against the current repository instead of the skills repo, so it works without additional App permissions.
Sensitive Change Detection (shadow mode)This PR modifies control-plane files:
|
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
Adjusts the sync-skills job in the release workflow to use least-privilege permissions for the GitHub App token (skills repo) and to route failure notifications through the current repository’s github.token, avoiding missing App installation permissions.
Changes:
- Add
issues: writeto thesync-skillsjob so the job can file/comment on issues in the current repo. - Remove unused
pull-requests/issuespermissions from the skills repo App token request (keep onlycontents: write). - Update the failure notification step to authenticate with
github.tokenand target${{ github.repository }}for issue operations and run links.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
permission-pull-requests: writeandpermission-issues: writefrom the skills repo token — the sync script only needscontents:writefor git push, and the App installation onbasecamp/skillsdoesn't grant the othersgithub.tokenagainst the current repo (issues: writeadded to job-level permissions) so it works without additional App permissionsTest plan
Both items require a tagged release to exercise the
sync-skillsjob. The changes are workflow-only and mechanically correct: excess permissions removed, notification retargeted togithub.token+github.repository.