Parent: #495 · Unplanned fix surfaced by #497 ring-0 validation. · Work type: Security
The pr-review review job died at verify-auth-scopes because DON_PETRY_BOT_GH_PAT held a fine-grained PAT, which cannot gh pr review --approve (addPullRequestReview). This was the core cause of the agent never approving at green CI → the 12h stuck-PR/REVIEW_REQUIRED saga.
Fix (shipped): added org secret DON_PETRY_BOT_GH_PAT_CLASSIC (classic; repo/workflow/read:org); approval-path workflows now use ${{ secrets.DON_PETRY_BOT_GH_PAT_CLASSIC || secrets.DON_PETRY_BOT_GH_PAT }} (pr-review.yml, repair-pr-approvals.yml). Documented in machine-user-setup.md.
PR #530 → pr-review/v1.3.0. Validated: donpetry-bot now APPROVES (e.g. #522/#484/#483/#474); #522 merged autonomously.
Parent: #495 · Unplanned fix surfaced by #497 ring-0 validation. · Work type: Security
The pr-review review job died at
verify-auth-scopesbecauseDON_PETRY_BOT_GH_PATheld a fine-grained PAT, which cannotgh pr review --approve(addPullRequestReview). This was the core cause of the agent never approving at green CI → the 12h stuck-PR/REVIEW_REQUIRED saga.Fix (shipped): added org secret
DON_PETRY_BOT_GH_PAT_CLASSIC(classic; repo/workflow/read:org); approval-path workflows now use${{ secrets.DON_PETRY_BOT_GH_PAT_CLASSIC || secrets.DON_PETRY_BOT_GH_PAT }}(pr-review.yml, repair-pr-approvals.yml). Documented in machine-user-setup.md.PR #530 →
pr-review/v1.3.0. Validated: donpetry-bot now APPROVES (e.g. #522/#484/#483/#474); #522 merged autonomously.