Skip to content

Auth: bot needs a classic PAT for PR approvals (fine-grained can't addPullRequestReview) #532

Description

@don-petry

Parent: #495 · Unplanned fix surfaced by #497 ring-0 validation. · Work type: Security

The pr-review review job died at verify-auth-scopes because DON_PETRY_BOT_GH_PAT held a fine-grained PAT, which cannot gh pr review --approve (addPullRequestReview). This was the core cause of the agent never approving at green CI → the 12h stuck-PR/REVIEW_REQUIRED saga.

Fix (shipped): added org secret DON_PETRY_BOT_GH_PAT_CLASSIC (classic; repo/workflow/read:org); approval-path workflows now use ${{ secrets.DON_PETRY_BOT_GH_PAT_CLASSIC || secrets.DON_PETRY_BOT_GH_PAT }} (pr-review.yml, repair-pr-approvals.yml). Documented in machine-user-setup.md.

PR #530pr-review/v1.3.0. Validated: donpetry-bot now APPROVES (e.g. #522/#484/#483/#474); #522 merged autonomously.

Metadata

Metadata

Assignees

No one assigned

    Labels

    initiativeEpic / initiative tracking issuesecuritySecurity-related PRs and issues

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions