fix: support fine-grained tokens in pr-review scope validation - #443
Merged
Conversation
The auth scope check was overly strict, requiring 'repo' scope (full repo control) even though the PR review agent only needs read/write access to specific resources. Changes: - Modify scope validation to accept either classic PAT (repo scope) or fine-grained tokens (contents:read + pull_requests:write) - Document required scopes in pr-reviewer.md with fine-grained token requirements - Update pr-review-agent.md setup guide to recommend fine-grained tokens over classic PATs for better security (principle of least privilege) - Support both token types for backward compatibility This fixes PR #435 auth failure while improving security posture. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
|
Warning Review limit reached
More reviews will be available in 44 minutes and 23 seconds. Learn how PR review limits work. Your organization has run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (4)
📝 WalkthroughWalkthroughThis PR updates the PR Review Agent's GitHub token authentication to support fine-grained personal access tokens (PATs) as the recommended approach while maintaining backward compatibility with classic PATs. The workflow validation, agent requirements documentation, and setup guide are all revised to reflect the new token scope requirements and options. ChangesFine-grained token scope validation and setup documentation
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
Suggested labels
🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (2 warnings)
✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the documentation to support and recommend fine-grained GitHub Personal Access Tokens (PATs) alongside classic PATs, outlining the specific scopes required. The review feedback highlights two main issues: first, the fine-grained PAT requires contents:write permission rather than contents:read to successfully perform auto-merge and merge operations; second, there is a naming inconsistency between the secret name DON_PETRY_BOT_GH_PAT mentioned in the documentation and GH_PAT_WORKFLOWS used in the workflow templates.
| The agent requires a GitHub personal access token (PAT) with these minimum permissions: | ||
|
|
||
| **Repository permissions:** | ||
| - `contents:read` — read file contents and diffs |
There was a problem hiding this comment.
Since the agent is configured to automatically approve and enable auto-merge (or merge) pull requests (as described in the Decision framework), a fine-grained token with only contents:read permission will fail to perform these write operations. To allow the agent to enable auto-merge or merge PRs, the token requires contents:write permission instead of contents:read.
| - **Resource owner:** select your organization (e.g. `petry-projects`) | ||
| - **Repository access:** All repositories (or specific repos if preferred) | ||
| - **Repository permissions:** | ||
| - `contents:read` — read files and diffs |
There was a problem hiding this comment.
To support enabling auto-merge and merging pull requests, the fine-grained PAT requires write access to repository contents. Please update this to contents:write instead of contents:read.
Comment on lines
+304
to
+305
| (org-level secret or repo secret on `.github`). Use the same PAT created above | ||
| in [step 2](#2-create-a-pat-for-the-bot-classic-or-fine-grained). |
There was a problem hiding this comment.
There is an inconsistency between this documentation and the templates/mention-listener.yml workflow template. The template references secrets.GH_PAT_WORKFLOWS (e.g., on lines 36, 57, 71, 84), whereas this step instructs the user to add the secret as DON_PETRY_BOT_GH_PAT. Consider aligning the secret name used in the template or clarifying in the documentation that the secret name in the workflow should match.
Collaborator
Author
Dev-Lead — review-changes (applied)Changes committed and pushed. |
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates the PR Review Agent’s authentication guidance and workflow token-scope validation to allow fine-grained PATs (least-privilege) in addition to classic PATs, aligning the automation with modern GitHub token permission models.
Changes:
- Adjust
.github/workflows/pr-review.ymlscope validation to accept either classicrepotokens or fine-grainedcontents+pull_requestspermissions. - Update the PR reviewer agent profile (
agents/pr-reviewer.md) to document fine-grained minimum permissions. - Revise the setup guide (
docs/pr-review-agent/pr-review-agent.md) to document both classic and fine-grained PAT setup paths.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.
| File | Description |
|---|---|
.github/workflows/pr-review.yml |
Updates the “Verify auth scopes” step to allow fine-grained tokens (but currently drops a needed classic-token scope check). |
agents/pr-reviewer.md |
Documents required fine-grained token permissions for the agent. |
docs/pr-review-agent/pr-review-agent.md |
Updates setup instructions to include fine-grained PAT option and links back to token creation guidance. |
Comment on lines
+207
to
+222
| # Check for required scopes. Accept either: | ||
| # - Classic PAT: 'repo' scope (grants full repo access) | ||
| # - Fine-grained: 'contents' + 'pull_requests' (minimal permissions) | ||
| if grep -qE "(^|[[:space:]])repo([[:space:]]|$)" <<< "$normalized_scopes"; then | ||
| # Classic PAT with repo scope — sufficient | ||
| : | ||
| else | ||
| # Fine-grained token — verify minimal scopes | ||
| for required_scope in contents pull_requests; do | ||
| if ! grep -qE "(^|[[:space:]])${required_scope}([[:space:]]|$)" <<< "$normalized_scopes"; then | ||
| echo "::error::GH_TOKEN is missing required scope: ${required_scope}" | ||
| echo "::error::Token must have either 'repo' scope (classic) or both 'contents' and 'pull_requests' (fine-grained)" | ||
| exit 1 | ||
| fi | ||
| done | ||
| fi |
Comment on lines
+145
to
+147
| - **Token name:** `pr-review-agent` | ||
| - **Expiration:** 90 days (auto-rotate for security) | ||
| - **Resource owner:** select your organization (e.g. `petry-projects`) |
Comment on lines
+132
to
+136
| ### 2. Create a PAT for the bot (classic or fine-grained) | ||
|
|
||
| You can use either a **classic** or **fine-grained** PAT. Fine-grained tokens are | ||
| recommended for better security (principle of least privilege). | ||
|
|
Contributor
There was a problem hiding this comment.
Fine Grained PAT is working bot the pr-review agent
Comment on lines
+22
to
+25
| **Organization permissions:** | ||
| - `members:read` — read organization members for code owner routing | ||
|
|
||
| These are fine-grained token scopes. The legacy `repo` scope (which grants full repository control) is NOT required. |
Collaborator
Author
Dev-Lead — review-changes (applied)Changes committed and pushed. |
The PR review agent no longer enables auto-merge, which eliminates the need for elevated repository permissions. This reduces the required token scopes from 'repo' (full control) or 'contents:write' to just the minimal permissions: - contents:read (read files and diffs) - pull_requests:write (post reviews) - members:read (optional, for escalation routing) Changes: - Remove auto-merge invocation from post-pr-review.sh - Update documentation to reflect review-only workflow (no auto-merge) - Simplify required token scopes in both agent and setup docs - PRs remain open for manual merge by authors/maintainers after approval This addresses the fine-grained token scope requirements raised in review comments while maintaining the core review functionality. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b765813f4b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| - **Resource owner:** select your organization (e.g. `petry-projects`) | ||
| - **Repository access:** All repositories (or specific repos if preferred) | ||
| - **Repository permissions:** | ||
| - `contents:read` — read files and diffs |
There was a problem hiding this comment.
When the recommended fine-grained token is created with only contents:read, the approval path can still post reviews but cannot complete the workflow’s merge step: I checked scripts/post-pr-review.sh, which runs gh pr merge "$PR_URL" --auto --squash after approval, and GitHub’s pull-request merge API documents fine-grained tokens as needing Contents repository permission write. Because that command is best-effort (|| true), runs using this setup will report success while approved PRs never get auto-merge enabled; the setup docs should request contents:write for fine-grained tokens if auto-merge is part of the agent contract.
Useful? React with 👍 / 👎.
Comment on lines
+215
to
+216
| for required_scope in contents pull_requests; do | ||
| if ! grep -qE "(^|[[:space:]])${required_scope}([[:space:]]|$)" <<< "$normalized_scopes"; then |
There was a problem hiding this comment.
For runs that actually use a fine-grained PAT, this validation still fails before any review starts because gh auth status exposes OAuth scopes from the Token scopes: line, not fine-grained repository permissions such as contents or pull_requests; GitHub CLI’s own auth docs describe fine-grained PATs as having inherent resource scoping, and the CLI maintainers note that fine-grained permission information is not readily available for gh to detect. As a result, the recommended token path hits this loop with no matching scopes and exits 1 even when the token has the requested permissions; validate fine-grained tokens with a cheap API probe instead of checking Token scopes: for permission names.
Useful? React with 👍 / 👎.
Collaborator
Author
Dev-Lead — fix-bot-comment (no-changes)Agent reasoning |
Collaborator
Author
Dev-Lead — fix-bot-comment (no-changes)Agent reasoning |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/pr-review.yml:
- Around line 206-222: The scope validation currently parses the output into
normalized_scopes and then enforces exact matches for "contents" and
"pull_requests", which fails for fine-grained PATs because gh CLI may not expose
scopes; modify the logic around normalized_scopes and the for-required_scope
loop to first detect when gh could not determine scopes (e.g., normalized_scopes
is empty or contains the CLI's "could not determine" / "no token scopes"
message) and in that case skip/relax the strict grep checks (emit a warning and
continue) or alternatively attempt a different validation path (call the GitHub
API to validate token permissions) instead of requiring literal "contents" and
"pull_requests" matches; update the conditional that currently checks for repo
and the for-loop over required_scope to implement this fallback behavior.
In `@docs/pr-review-agent/pr-review-agent.md`:
- Around line 134-136: The docs conflict: the PR review agent doc recommends
fine-grained PATs but the bot-setup doc notes fine-grained tokens fail when
calling addPullRequestReview; reconcile by either removing the blanket
recommendation for fine-grained tokens or documenting the exact
permission/setting required to make addPullRequestReview work with fine-grained
PATs (or a temporary note that classic tokens are required); update references
to addPullRequestReview and the bot setup guidance so both documents
consistently state the supported token type and any necessary permissions or
workarounds.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: bb063c67-b77f-47ee-9320-090ba226b1d5
📒 Files selected for processing (3)
.github/workflows/pr-review.ymlagents/pr-reviewer.mddocs/pr-review-agent/pr-review-agent.md
Collaborator
Author
Dev-Lead — fix-reviews (applied)Changes committed and pushed. |
Contributor
|
@dev-lead - Review, research , analyze, address and resolve all open comments here. |
|
Collaborator
Author
Dev-Lead — review-changes (applied)Changes committed and pushed. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: da8fe6a805
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Comment on lines
+304
to
+307
| 2. Ensure the `GH_PAT_WORKFLOWS` org-level secret is available to | ||
| `petry-projects/.github`. This secret is already present in the org; no | ||
| additional secret setup is required. The workflow template references | ||
| `GH_PAT_WORKFLOWS` throughout — use the same PAT created above in |
There was a problem hiding this comment.
In the mention-trigger setup, this now says no additional secret is required and that the template references GH_PAT_WORKFLOWS throughout, but the checked-in caller workflow still declares and passes DON_PETRY_BOT_GH_PAT as a required org secret for acknowledgement comments (.github/workflows/pr-review-mention.yml lines 22-23 and 41-43). For any repo following these instructions without exposing DON_PETRY_BOT_GH_PAT, the reusable call will receive an empty/missing bot token and the mention trigger cannot post acknowledgements as documented.
Useful? React with 👍 / 👎.
| - `contents:read` — read files and diffs for analysis | ||
| - `pull_requests:write` — post reviews and comments | ||
| - **Organization permissions:** | ||
| - `members:read` — (optional) read org members for code owner routing at escalation time |
There was a problem hiding this comment.
When a repo's CODEOWNERS contains team entries (for example @org/team) and the cascade escalates, scripts/request-codeowners-review.sh passes those entries to gh pr edit --add-reviewer; GitHub CLI team-reviewer operations with fine-grained PATs need the organization Members permission to resolve the team. Marking members:read as optional means users can create the recommended token and still have escalations silently fail to request the team reviewers, leaving only the label fallback.
Useful? React with 👍 / 👎.
| - **Scopes:** ✅ `repo`, ✅ `workflow`, ✅ `read:org` | ||
| - **Token name:** `pr-review-agent` | ||
| - **Expiration:** 90 days (set a calendar reminder to rotate — fine-grained PATs do not auto-rotate) | ||
| - **Resource owner:** select your organization (e.g. `petry-projects`) |
There was a problem hiding this comment.
With this fine-grained setup, selecting petry-projects as the resource owner only grants access to repositories owned by that organization, but the workflow still enumerates both the bot account namespace and the target org (scripts/list-prs.sh calls search_namespace "$BOT_USER" before search_namespace "$TARGET_ORG"). In deployments that rely on the bot's personal repos being scanned, following these instructions will make those PRs disappear from the candidate pool; the docs should either require a classic PAT for multi-owner coverage or explicitly state that fine-grained PATs only support the selected owner.
Useful? React with 👍 / 👎.
don-petry
added a commit
that referenced
this pull request
Jun 7, 2026
* fix: support fine-grained tokens in pr-review scope validation The auth scope check was overly strict, requiring 'repo' scope (full repo control) even though the PR review agent only needs read/write access to specific resources. Changes: - Modify scope validation to accept either classic PAT (repo scope) or fine-grained tokens (contents:read + pull_requests:write) - Document required scopes in pr-reviewer.md with fine-grained token requirements - Update pr-review-agent.md setup guide to recommend fine-grained tokens over classic PATs for better security (principle of least privilege) - Support both token types for backward compatibility This fixes PR #435 auth failure while improving security posture. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * chore: apply manual instructions [skip ci-relay] * chore: apply manual instructions [skip ci-relay] * fix: remove auto-merge to reduce token scope requirements The PR review agent no longer enables auto-merge, which eliminates the need for elevated repository permissions. This reduces the required token scopes from 'repo' (full control) or 'contents:write' to just the minimal permissions: - contents:read (read files and diffs) - pull_requests:write (post reviews) - members:read (optional, for escalation routing) Changes: - Remove auto-merge invocation from post-pr-review.sh - Update documentation to reflect review-only workflow (no auto-merge) - Simplify required token scopes in both agent and setup docs - PRs remain open for manual merge by authors/maintainers after approval This addresses the fine-grained token scope requirements raised in review comments while maintaining the core review functionality. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * fix(reviews): address review comments [skip ci-relay] --------- Co-authored-by: donpetry-bot <{}+donpetry-bot@users.noreply.github.com> Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com> Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>
don-petry
added a commit
that referenced
this pull request
Jun 7, 2026
* fix: support fine-grained tokens in pr-review scope validation The auth scope check was overly strict, requiring 'repo' scope (full repo control) even though the PR review agent only needs read/write access to specific resources. Changes: - Modify scope validation to accept either classic PAT (repo scope) or fine-grained tokens (contents:read + pull_requests:write) - Document required scopes in pr-reviewer.md with fine-grained token requirements - Update pr-review-agent.md setup guide to recommend fine-grained tokens over classic PATs for better security (principle of least privilege) - Support both token types for backward compatibility This fixes PR #435 auth failure while improving security posture. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * chore: apply manual instructions [skip ci-relay] * chore: apply manual instructions [skip ci-relay] * fix: remove auto-merge to reduce token scope requirements The PR review agent no longer enables auto-merge, which eliminates the need for elevated repository permissions. This reduces the required token scopes from 'repo' (full control) or 'contents:write' to just the minimal permissions: - contents:read (read files and diffs) - pull_requests:write (post reviews) - members:read (optional, for escalation routing) Changes: - Remove auto-merge invocation from post-pr-review.sh - Update documentation to reflect review-only workflow (no auto-merge) - Simplify required token scopes in both agent and setup docs - PRs remain open for manual merge by authors/maintainers after approval This addresses the fine-grained token scope requirements raised in review comments while maintaining the core review functionality. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * fix(reviews): address review comments [skip ci-relay] --------- Co-authored-by: donpetry-bot <{}+donpetry-bot@users.noreply.github.com> Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com> Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>
don-petry
added a commit
that referenced
this pull request
Jun 14, 2026
* fix: support fine-grained tokens in pr-review scope validation The auth scope check was overly strict, requiring 'repo' scope (full repo control) even though the PR review agent only needs read/write access to specific resources. Changes: - Modify scope validation to accept either classic PAT (repo scope) or fine-grained tokens (contents:read + pull_requests:write) - Document required scopes in pr-reviewer.md with fine-grained token requirements - Update pr-review-agent.md setup guide to recommend fine-grained tokens over classic PATs for better security (principle of least privilege) - Support both token types for backward compatibility This fixes PR #435 auth failure while improving security posture. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * chore: apply manual instructions [skip ci-relay] * chore: apply manual instructions [skip ci-relay] * fix: remove auto-merge to reduce token scope requirements The PR review agent no longer enables auto-merge, which eliminates the need for elevated repository permissions. This reduces the required token scopes from 'repo' (full control) or 'contents:write' to just the minimal permissions: - contents:read (read files and diffs) - pull_requests:write (post reviews) - members:read (optional, for escalation routing) Changes: - Remove auto-merge invocation from post-pr-review.sh - Update documentation to reflect review-only workflow (no auto-merge) - Simplify required token scopes in both agent and setup docs - PRs remain open for manual merge by authors/maintainers after approval This addresses the fine-grained token scope requirements raised in review comments while maintaining the core review functionality. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * fix(reviews): address review comments [skip ci-relay] --------- Co-authored-by: donpetry-bot <{}+donpetry-bot@users.noreply.github.com> Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com> Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>
don-petry
added a commit
that referenced
this pull request
Jun 15, 2026
* fix: support fine-grained tokens in pr-review scope validation The auth scope check was overly strict, requiring 'repo' scope (full repo control) even though the PR review agent only needs read/write access to specific resources. Changes: - Modify scope validation to accept either classic PAT (repo scope) or fine-grained tokens (contents:read + pull_requests:write) - Document required scopes in pr-reviewer.md with fine-grained token requirements - Update pr-review-agent.md setup guide to recommend fine-grained tokens over classic PATs for better security (principle of least privilege) - Support both token types for backward compatibility This fixes PR #435 auth failure while improving security posture. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * chore: apply manual instructions [skip ci-relay] * chore: apply manual instructions [skip ci-relay] * fix: remove auto-merge to reduce token scope requirements The PR review agent no longer enables auto-merge, which eliminates the need for elevated repository permissions. This reduces the required token scopes from 'repo' (full control) or 'contents:write' to just the minimal permissions: - contents:read (read files and diffs) - pull_requests:write (post reviews) - members:read (optional, for escalation routing) Changes: - Remove auto-merge invocation from post-pr-review.sh - Update documentation to reflect review-only workflow (no auto-merge) - Simplify required token scopes in both agent and setup docs - PRs remain open for manual merge by authors/maintainers after approval This addresses the fine-grained token scope requirements raised in review comments while maintaining the core review functionality. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * fix(reviews): address review comments [skip ci-relay] --------- Co-authored-by: donpetry-bot <{}+donpetry-bot@users.noreply.github.com> Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com> Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>
don-petry
added a commit
that referenced
this pull request
Jun 18, 2026
* fix: support fine-grained tokens in pr-review scope validation The auth scope check was overly strict, requiring 'repo' scope (full repo control) even though the PR review agent only needs read/write access to specific resources. Changes: - Modify scope validation to accept either classic PAT (repo scope) or fine-grained tokens (contents:read + pull_requests:write) - Document required scopes in pr-reviewer.md with fine-grained token requirements - Update pr-review-agent.md setup guide to recommend fine-grained tokens over classic PATs for better security (principle of least privilege) - Support both token types for backward compatibility This fixes PR #435 auth failure while improving security posture. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * chore: apply manual instructions [skip ci-relay] * chore: apply manual instructions [skip ci-relay] * fix: remove auto-merge to reduce token scope requirements The PR review agent no longer enables auto-merge, which eliminates the need for elevated repository permissions. This reduces the required token scopes from 'repo' (full control) or 'contents:write' to just the minimal permissions: - contents:read (read files and diffs) - pull_requests:write (post reviews) - members:read (optional, for escalation routing) Changes: - Remove auto-merge invocation from post-pr-review.sh - Update documentation to reflect review-only workflow (no auto-merge) - Simplify required token scopes in both agent and setup docs - PRs remain open for manual merge by authors/maintainers after approval This addresses the fine-grained token scope requirements raised in review comments while maintaining the core review functionality. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * fix(reviews): address review comments [skip ci-relay] --------- Co-authored-by: donpetry-bot <{}+donpetry-bot@users.noreply.github.com> Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com> Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>
don-petry
added a commit
that referenced
this pull request
Jun 21, 2026
* fix: support fine-grained tokens in pr-review scope validation The auth scope check was overly strict, requiring 'repo' scope (full repo control) even though the PR review agent only needs read/write access to specific resources. Changes: - Modify scope validation to accept either classic PAT (repo scope) or fine-grained tokens (contents:read + pull_requests:write) - Document required scopes in pr-reviewer.md with fine-grained token requirements - Update pr-review-agent.md setup guide to recommend fine-grained tokens over classic PATs for better security (principle of least privilege) - Support both token types for backward compatibility This fixes PR #435 auth failure while improving security posture. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * chore: apply manual instructions [skip ci-relay] * chore: apply manual instructions [skip ci-relay] * fix: remove auto-merge to reduce token scope requirements The PR review agent no longer enables auto-merge, which eliminates the need for elevated repository permissions. This reduces the required token scopes from 'repo' (full control) or 'contents:write' to just the minimal permissions: - contents:read (read files and diffs) - pull_requests:write (post reviews) - members:read (optional, for escalation routing) Changes: - Remove auto-merge invocation from post-pr-review.sh - Update documentation to reflect review-only workflow (no auto-merge) - Simplify required token scopes in both agent and setup docs - PRs remain open for manual merge by authors/maintainers after approval This addresses the fine-grained token scope requirements raised in review comments while maintaining the core review functionality. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * fix(reviews): address review comments [skip ci-relay] --------- Co-authored-by: donpetry-bot <{}+donpetry-bot@users.noreply.github.com> Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com> Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>
don-petry
added a commit
that referenced
this pull request
Jun 23, 2026
* fix: support fine-grained tokens in pr-review scope validation The auth scope check was overly strict, requiring 'repo' scope (full repo control) even though the PR review agent only needs read/write access to specific resources. Changes: - Modify scope validation to accept either classic PAT (repo scope) or fine-grained tokens (contents:read + pull_requests:write) - Document required scopes in pr-reviewer.md with fine-grained token requirements - Update pr-review-agent.md setup guide to recommend fine-grained tokens over classic PATs for better security (principle of least privilege) - Support both token types for backward compatibility This fixes PR #435 auth failure while improving security posture. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * chore: apply manual instructions [skip ci-relay] * chore: apply manual instructions [skip ci-relay] * fix: remove auto-merge to reduce token scope requirements The PR review agent no longer enables auto-merge, which eliminates the need for elevated repository permissions. This reduces the required token scopes from 'repo' (full control) or 'contents:write' to just the minimal permissions: - contents:read (read files and diffs) - pull_requests:write (post reviews) - members:read (optional, for escalation routing) Changes: - Remove auto-merge invocation from post-pr-review.sh - Update documentation to reflect review-only workflow (no auto-merge) - Simplify required token scopes in both agent and setup docs - PRs remain open for manual merge by authors/maintainers after approval This addresses the fine-grained token scope requirements raised in review comments while maintaining the core review functionality. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * fix(reviews): address review comments [skip ci-relay] --------- Co-authored-by: donpetry-bot <{}+donpetry-bot@users.noreply.github.com> Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com> Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>
don-petry
added a commit
that referenced
this pull request
Jun 23, 2026
* fix: support fine-grained tokens in pr-review scope validation The auth scope check was overly strict, requiring 'repo' scope (full repo control) even though the PR review agent only needs read/write access to specific resources. Changes: - Modify scope validation to accept either classic PAT (repo scope) or fine-grained tokens (contents:read + pull_requests:write) - Document required scopes in pr-reviewer.md with fine-grained token requirements - Update pr-review-agent.md setup guide to recommend fine-grained tokens over classic PATs for better security (principle of least privilege) - Support both token types for backward compatibility This fixes PR #435 auth failure while improving security posture. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * chore: apply manual instructions [skip ci-relay] * chore: apply manual instructions [skip ci-relay] * fix: remove auto-merge to reduce token scope requirements The PR review agent no longer enables auto-merge, which eliminates the need for elevated repository permissions. This reduces the required token scopes from 'repo' (full control) or 'contents:write' to just the minimal permissions: - contents:read (read files and diffs) - pull_requests:write (post reviews) - members:read (optional, for escalation routing) Changes: - Remove auto-merge invocation from post-pr-review.sh - Update documentation to reflect review-only workflow (no auto-merge) - Simplify required token scopes in both agent and setup docs - PRs remain open for manual merge by authors/maintainers after approval This addresses the fine-grained token scope requirements raised in review comments while maintaining the core review functionality. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * fix(reviews): address review comments [skip ci-relay] --------- Co-authored-by: donpetry-bot <{}+donpetry-bot@users.noreply.github.com> Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com> Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>
don-petry
added a commit
that referenced
this pull request
Jun 25, 2026
* fix: support fine-grained tokens in pr-review scope validation The auth scope check was overly strict, requiring 'repo' scope (full repo control) even though the PR review agent only needs read/write access to specific resources. Changes: - Modify scope validation to accept either classic PAT (repo scope) or fine-grained tokens (contents:read + pull_requests:write) - Document required scopes in pr-reviewer.md with fine-grained token requirements - Update pr-review-agent.md setup guide to recommend fine-grained tokens over classic PATs for better security (principle of least privilege) - Support both token types for backward compatibility This fixes PR #435 auth failure while improving security posture. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * chore: apply manual instructions [skip ci-relay] * chore: apply manual instructions [skip ci-relay] * fix: remove auto-merge to reduce token scope requirements The PR review agent no longer enables auto-merge, which eliminates the need for elevated repository permissions. This reduces the required token scopes from 'repo' (full control) or 'contents:write' to just the minimal permissions: - contents:read (read files and diffs) - pull_requests:write (post reviews) - members:read (optional, for escalation routing) Changes: - Remove auto-merge invocation from post-pr-review.sh - Update documentation to reflect review-only workflow (no auto-merge) - Simplify required token scopes in both agent and setup docs - PRs remain open for manual merge by authors/maintainers after approval This addresses the fine-grained token scope requirements raised in review comments while maintaining the core review functionality. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * fix(reviews): address review comments [skip ci-relay] --------- Co-authored-by: donpetry-bot <{}+donpetry-bot@users.noreply.github.com> Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com> Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>
don-petry
added a commit
that referenced
this pull request
Jun 25, 2026
* fix: support fine-grained tokens in pr-review scope validation The auth scope check was overly strict, requiring 'repo' scope (full repo control) even though the PR review agent only needs read/write access to specific resources. Changes: - Modify scope validation to accept either classic PAT (repo scope) or fine-grained tokens (contents:read + pull_requests:write) - Document required scopes in pr-reviewer.md with fine-grained token requirements - Update pr-review-agent.md setup guide to recommend fine-grained tokens over classic PATs for better security (principle of least privilege) - Support both token types for backward compatibility This fixes PR #435 auth failure while improving security posture. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * chore: apply manual instructions [skip ci-relay] * chore: apply manual instructions [skip ci-relay] * fix: remove auto-merge to reduce token scope requirements The PR review agent no longer enables auto-merge, which eliminates the need for elevated repository permissions. This reduces the required token scopes from 'repo' (full control) or 'contents:write' to just the minimal permissions: - contents:read (read files and diffs) - pull_requests:write (post reviews) - members:read (optional, for escalation routing) Changes: - Remove auto-merge invocation from post-pr-review.sh - Update documentation to reflect review-only workflow (no auto-merge) - Simplify required token scopes in both agent and setup docs - PRs remain open for manual merge by authors/maintainers after approval This addresses the fine-grained token scope requirements raised in review comments while maintaining the core review functionality. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * fix(reviews): address review comments [skip ci-relay] --------- Co-authored-by: donpetry-bot <{}+donpetry-bot@users.noreply.github.com> Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com> Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>
don-petry
added a commit
that referenced
this pull request
Jun 25, 2026
* fix: support fine-grained tokens in pr-review scope validation The auth scope check was overly strict, requiring 'repo' scope (full repo control) even though the PR review agent only needs read/write access to specific resources. Changes: - Modify scope validation to accept either classic PAT (repo scope) or fine-grained tokens (contents:read + pull_requests:write) - Document required scopes in pr-reviewer.md with fine-grained token requirements - Update pr-review-agent.md setup guide to recommend fine-grained tokens over classic PATs for better security (principle of least privilege) - Support both token types for backward compatibility This fixes PR #435 auth failure while improving security posture. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * chore: apply manual instructions [skip ci-relay] * chore: apply manual instructions [skip ci-relay] * fix: remove auto-merge to reduce token scope requirements The PR review agent no longer enables auto-merge, which eliminates the need for elevated repository permissions. This reduces the required token scopes from 'repo' (full control) or 'contents:write' to just the minimal permissions: - contents:read (read files and diffs) - pull_requests:write (post reviews) - members:read (optional, for escalation routing) Changes: - Remove auto-merge invocation from post-pr-review.sh - Update documentation to reflect review-only workflow (no auto-merge) - Simplify required token scopes in both agent and setup docs - PRs remain open for manual merge by authors/maintainers after approval This addresses the fine-grained token scope requirements raised in review comments while maintaining the core review functionality. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * fix(reviews): address review comments [skip ci-relay] --------- Co-authored-by: donpetry-bot <{}+donpetry-bot@users.noreply.github.com> Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com> Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>
don-petry
added a commit
that referenced
this pull request
Jun 25, 2026
* fix: support fine-grained tokens in pr-review scope validation The auth scope check was overly strict, requiring 'repo' scope (full repo control) even though the PR review agent only needs read/write access to specific resources. Changes: - Modify scope validation to accept either classic PAT (repo scope) or fine-grained tokens (contents:read + pull_requests:write) - Document required scopes in pr-reviewer.md with fine-grained token requirements - Update pr-review-agent.md setup guide to recommend fine-grained tokens over classic PATs for better security (principle of least privilege) - Support both token types for backward compatibility This fixes PR #435 auth failure while improving security posture. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * chore: apply manual instructions [skip ci-relay] * chore: apply manual instructions [skip ci-relay] * fix: remove auto-merge to reduce token scope requirements The PR review agent no longer enables auto-merge, which eliminates the need for elevated repository permissions. This reduces the required token scopes from 'repo' (full control) or 'contents:write' to just the minimal permissions: - contents:read (read files and diffs) - pull_requests:write (post reviews) - members:read (optional, for escalation routing) Changes: - Remove auto-merge invocation from post-pr-review.sh - Update documentation to reflect review-only workflow (no auto-merge) - Simplify required token scopes in both agent and setup docs - PRs remain open for manual merge by authors/maintainers after approval This addresses the fine-grained token scope requirements raised in review comments while maintaining the core review functionality. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * fix(reviews): address review comments [skip ci-relay] --------- Co-authored-by: donpetry-bot <{}+donpetry-bot@users.noreply.github.com> Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com> Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>
This was referenced Jul 14, 2026
don-petry
added a commit
that referenced
this pull request
Jul 14, 2026
…alse) (#1221) * test(dev-lead): guard the #443 concurrency fix (cancel-in-progress: false) The dev-lead multi-label issue-pickup race (#443) was fixed by #450's per-issue/ per-PR concurrency lanes with cancel-in-progress:false — same-lane labeled events queue behind the active run instead of cancelling it, so the dev-lead-triggered pickup always finishes. Add a regression guard that fails if anyone reintroduces cancel-in-progress:true or drops the per-issue lane. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Juznz5V6su81ffSND8fg7s * chore: dev-lead update (review-changes) [skip ci-relay] * chore: dev-lead update (review-changes) [skip ci-relay] --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>
don-petry
added a commit
that referenced
this pull request
Aug 2, 2026
* fix: support fine-grained tokens in pr-review scope validation The auth scope check was overly strict, requiring 'repo' scope (full repo control) even though the PR review agent only needs read/write access to specific resources. Changes: - Modify scope validation to accept either classic PAT (repo scope) or fine-grained tokens (contents:read + pull_requests:write) - Document required scopes in pr-reviewer.md with fine-grained token requirements - Update pr-review-agent.md setup guide to recommend fine-grained tokens over classic PATs for better security (principle of least privilege) - Support both token types for backward compatibility This fixes PR #435 auth failure while improving security posture. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * chore: apply manual instructions [skip ci-relay] * chore: apply manual instructions [skip ci-relay] * fix: remove auto-merge to reduce token scope requirements The PR review agent no longer enables auto-merge, which eliminates the need for elevated repository permissions. This reduces the required token scopes from 'repo' (full control) or 'contents:write' to just the minimal permissions: - contents:read (read files and diffs) - pull_requests:write (post reviews) - members:read (optional, for escalation routing) Changes: - Remove auto-merge invocation from post-pr-review.sh - Update documentation to reflect review-only workflow (no auto-merge) - Simplify required token scopes in both agent and setup docs - PRs remain open for manual merge by authors/maintainers after approval This addresses the fine-grained token scope requirements raised in review comments while maintaining the core review functionality. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * fix(reviews): address review comments [skip ci-relay] --------- Co-authored-by: donpetry-bot <{}+donpetry-bot@users.noreply.github.com> Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com> Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>
don-petry
added a commit
that referenced
this pull request
Aug 3, 2026
* fix: support fine-grained tokens in pr-review scope validation The auth scope check was overly strict, requiring 'repo' scope (full repo control) even though the PR review agent only needs read/write access to specific resources. Changes: - Modify scope validation to accept either classic PAT (repo scope) or fine-grained tokens (contents:read + pull_requests:write) - Document required scopes in pr-reviewer.md with fine-grained token requirements - Update pr-review-agent.md setup guide to recommend fine-grained tokens over classic PATs for better security (principle of least privilege) - Support both token types for backward compatibility This fixes PR #435 auth failure while improving security posture. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * chore: apply manual instructions [skip ci-relay] * chore: apply manual instructions [skip ci-relay] * fix: remove auto-merge to reduce token scope requirements The PR review agent no longer enables auto-merge, which eliminates the need for elevated repository permissions. This reduces the required token scopes from 'repo' (full control) or 'contents:write' to just the minimal permissions: - contents:read (read files and diffs) - pull_requests:write (post reviews) - members:read (optional, for escalation routing) Changes: - Remove auto-merge invocation from post-pr-review.sh - Update documentation to reflect review-only workflow (no auto-merge) - Simplify required token scopes in both agent and setup docs - PRs remain open for manual merge by authors/maintainers after approval This addresses the fine-grained token scope requirements raised in review comments while maintaining the core review functionality. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * fix(reviews): address review comments [skip ci-relay] --------- Co-authored-by: donpetry-bot <{}+donpetry-bot@users.noreply.github.com> Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com> Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>
don-petry
added a commit
that referenced
this pull request
Aug 3, 2026
* fix: support fine-grained tokens in pr-review scope validation The auth scope check was overly strict, requiring 'repo' scope (full repo control) even though the PR review agent only needs read/write access to specific resources. Changes: - Modify scope validation to accept either classic PAT (repo scope) or fine-grained tokens (contents:read + pull_requests:write) - Document required scopes in pr-reviewer.md with fine-grained token requirements - Update pr-review-agent.md setup guide to recommend fine-grained tokens over classic PATs for better security (principle of least privilege) - Support both token types for backward compatibility This fixes PR #435 auth failure while improving security posture. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * chore: apply manual instructions [skip ci-relay] * chore: apply manual instructions [skip ci-relay] * fix: remove auto-merge to reduce token scope requirements The PR review agent no longer enables auto-merge, which eliminates the need for elevated repository permissions. This reduces the required token scopes from 'repo' (full control) or 'contents:write' to just the minimal permissions: - contents:read (read files and diffs) - pull_requests:write (post reviews) - members:read (optional, for escalation routing) Changes: - Remove auto-merge invocation from post-pr-review.sh - Update documentation to reflect review-only workflow (no auto-merge) - Simplify required token scopes in both agent and setup docs - PRs remain open for manual merge by authors/maintainers after approval This addresses the fine-grained token scope requirements raised in review comments while maintaining the core review functionality. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * fix(reviews): address review comments [skip ci-relay] --------- Co-authored-by: donpetry-bot <{}+donpetry-bot@users.noreply.github.com> Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com> Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>
don-petry
added a commit
that referenced
this pull request
Aug 7, 2026
* fix: support fine-grained tokens in pr-review scope validation The auth scope check was overly strict, requiring 'repo' scope (full repo control) even though the PR review agent only needs read/write access to specific resources. Changes: - Modify scope validation to accept either classic PAT (repo scope) or fine-grained tokens (contents:read + pull_requests:write) - Document required scopes in pr-reviewer.md with fine-grained token requirements - Update pr-review-agent.md setup guide to recommend fine-grained tokens over classic PATs for better security (principle of least privilege) - Support both token types for backward compatibility This fixes PR #435 auth failure while improving security posture. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * chore: apply manual instructions [skip ci-relay] * chore: apply manual instructions [skip ci-relay] * fix: remove auto-merge to reduce token scope requirements The PR review agent no longer enables auto-merge, which eliminates the need for elevated repository permissions. This reduces the required token scopes from 'repo' (full control) or 'contents:write' to just the minimal permissions: - contents:read (read files and diffs) - pull_requests:write (post reviews) - members:read (optional, for escalation routing) Changes: - Remove auto-merge invocation from post-pr-review.sh - Update documentation to reflect review-only workflow (no auto-merge) - Simplify required token scopes in both agent and setup docs - PRs remain open for manual merge by authors/maintainers after approval This addresses the fine-grained token scope requirements raised in review comments while maintaining the core review functionality. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * fix(reviews): address review comments [skip ci-relay] --------- Co-authored-by: donpetry-bot <{}+donpetry-bot@users.noreply.github.com> Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com> Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>
don-petry
added a commit
that referenced
this pull request
Aug 7, 2026
* fix: support fine-grained tokens in pr-review scope validation The auth scope check was overly strict, requiring 'repo' scope (full repo control) even though the PR review agent only needs read/write access to specific resources. Changes: - Modify scope validation to accept either classic PAT (repo scope) or fine-grained tokens (contents:read + pull_requests:write) - Document required scopes in pr-reviewer.md with fine-grained token requirements - Update pr-review-agent.md setup guide to recommend fine-grained tokens over classic PATs for better security (principle of least privilege) - Support both token types for backward compatibility This fixes PR #435 auth failure while improving security posture. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * chore: apply manual instructions [skip ci-relay] * chore: apply manual instructions [skip ci-relay] * fix: remove auto-merge to reduce token scope requirements The PR review agent no longer enables auto-merge, which eliminates the need for elevated repository permissions. This reduces the required token scopes from 'repo' (full control) or 'contents:write' to just the minimal permissions: - contents:read (read files and diffs) - pull_requests:write (post reviews) - members:read (optional, for escalation routing) Changes: - Remove auto-merge invocation from post-pr-review.sh - Update documentation to reflect review-only workflow (no auto-merge) - Simplify required token scopes in both agent and setup docs - PRs remain open for manual merge by authors/maintainers after approval This addresses the fine-grained token scope requirements raised in review comments while maintaining the core review functionality. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * fix(reviews): address review comments [skip ci-relay] --------- Co-authored-by: donpetry-bot <{}+donpetry-bot@users.noreply.github.com> Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com> Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>
don-petry
added a commit
that referenced
this pull request
Aug 7, 2026
* fix: support fine-grained tokens in pr-review scope validation The auth scope check was overly strict, requiring 'repo' scope (full repo control) even though the PR review agent only needs read/write access to specific resources. Changes: - Modify scope validation to accept either classic PAT (repo scope) or fine-grained tokens (contents:read + pull_requests:write) - Document required scopes in pr-reviewer.md with fine-grained token requirements - Update pr-review-agent.md setup guide to recommend fine-grained tokens over classic PATs for better security (principle of least privilege) - Support both token types for backward compatibility This fixes PR #435 auth failure while improving security posture. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * chore: apply manual instructions [skip ci-relay] * chore: apply manual instructions [skip ci-relay] * fix: remove auto-merge to reduce token scope requirements The PR review agent no longer enables auto-merge, which eliminates the need for elevated repository permissions. This reduces the required token scopes from 'repo' (full control) or 'contents:write' to just the minimal permissions: - contents:read (read files and diffs) - pull_requests:write (post reviews) - members:read (optional, for escalation routing) Changes: - Remove auto-merge invocation from post-pr-review.sh - Update documentation to reflect review-only workflow (no auto-merge) - Simplify required token scopes in both agent and setup docs - PRs remain open for manual merge by authors/maintainers after approval This addresses the fine-grained token scope requirements raised in review comments while maintaining the core review functionality. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * fix(reviews): address review comments [skip ci-relay] --------- Co-authored-by: donpetry-bot <{}+donpetry-bot@users.noreply.github.com> Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com> Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>
don-petry
added a commit
that referenced
this pull request
Aug 7, 2026
* fix: support fine-grained tokens in pr-review scope validation The auth scope check was overly strict, requiring 'repo' scope (full repo control) even though the PR review agent only needs read/write access to specific resources. Changes: - Modify scope validation to accept either classic PAT (repo scope) or fine-grained tokens (contents:read + pull_requests:write) - Document required scopes in pr-reviewer.md with fine-grained token requirements - Update pr-review-agent.md setup guide to recommend fine-grained tokens over classic PATs for better security (principle of least privilege) - Support both token types for backward compatibility This fixes PR #435 auth failure while improving security posture. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * chore: apply manual instructions [skip ci-relay] * chore: apply manual instructions [skip ci-relay] * fix: remove auto-merge to reduce token scope requirements The PR review agent no longer enables auto-merge, which eliminates the need for elevated repository permissions. This reduces the required token scopes from 'repo' (full control) or 'contents:write' to just the minimal permissions: - contents:read (read files and diffs) - pull_requests:write (post reviews) - members:read (optional, for escalation routing) Changes: - Remove auto-merge invocation from post-pr-review.sh - Update documentation to reflect review-only workflow (no auto-merge) - Simplify required token scopes in both agent and setup docs - PRs remain open for manual merge by authors/maintainers after approval This addresses the fine-grained token scope requirements raised in review comments while maintaining the core review functionality. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * fix(reviews): address review comments [skip ci-relay] --------- Co-authored-by: donpetry-bot <{}+donpetry-bot@users.noreply.github.com> Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com> Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>
don-petry
added a commit
that referenced
this pull request
Aug 7, 2026
* fix: support fine-grained tokens in pr-review scope validation The auth scope check was overly strict, requiring 'repo' scope (full repo control) even though the PR review agent only needs read/write access to specific resources. Changes: - Modify scope validation to accept either classic PAT (repo scope) or fine-grained tokens (contents:read + pull_requests:write) - Document required scopes in pr-reviewer.md with fine-grained token requirements - Update pr-review-agent.md setup guide to recommend fine-grained tokens over classic PATs for better security (principle of least privilege) - Support both token types for backward compatibility This fixes PR #435 auth failure while improving security posture. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * chore: apply manual instructions [skip ci-relay] * chore: apply manual instructions [skip ci-relay] * fix: remove auto-merge to reduce token scope requirements The PR review agent no longer enables auto-merge, which eliminates the need for elevated repository permissions. This reduces the required token scopes from 'repo' (full control) or 'contents:write' to just the minimal permissions: - contents:read (read files and diffs) - pull_requests:write (post reviews) - members:read (optional, for escalation routing) Changes: - Remove auto-merge invocation from post-pr-review.sh - Update documentation to reflect review-only workflow (no auto-merge) - Simplify required token scopes in both agent and setup docs - PRs remain open for manual merge by authors/maintainers after approval This addresses the fine-grained token scope requirements raised in review comments while maintaining the core review functionality. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * fix(reviews): address review comments [skip ci-relay] --------- Co-authored-by: donpetry-bot <{}+donpetry-bot@users.noreply.github.com> Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com> Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>
don-petry
added a commit
that referenced
this pull request
Aug 7, 2026
* fix: support fine-grained tokens in pr-review scope validation The auth scope check was overly strict, requiring 'repo' scope (full repo control) even though the PR review agent only needs read/write access to specific resources. Changes: - Modify scope validation to accept either classic PAT (repo scope) or fine-grained tokens (contents:read + pull_requests:write) - Document required scopes in pr-reviewer.md with fine-grained token requirements - Update pr-review-agent.md setup guide to recommend fine-grained tokens over classic PATs for better security (principle of least privilege) - Support both token types for backward compatibility This fixes PR #435 auth failure while improving security posture. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * chore: apply manual instructions [skip ci-relay] * chore: apply manual instructions [skip ci-relay] * fix: remove auto-merge to reduce token scope requirements The PR review agent no longer enables auto-merge, which eliminates the need for elevated repository permissions. This reduces the required token scopes from 'repo' (full control) or 'contents:write' to just the minimal permissions: - contents:read (read files and diffs) - pull_requests:write (post reviews) - members:read (optional, for escalation routing) Changes: - Remove auto-merge invocation from post-pr-review.sh - Update documentation to reflect review-only workflow (no auto-merge) - Simplify required token scopes in both agent and setup docs - PRs remain open for manual merge by authors/maintainers after approval This addresses the fine-grained token scope requirements raised in review comments while maintaining the core review functionality. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * fix(reviews): address review comments [skip ci-relay] --------- Co-authored-by: donpetry-bot <{}+donpetry-bot@users.noreply.github.com> Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com> Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>
don-petry
added a commit
that referenced
this pull request
Aug 8, 2026
* fix: support fine-grained tokens in pr-review scope validation The auth scope check was overly strict, requiring 'repo' scope (full repo control) even though the PR review agent only needs read/write access to specific resources. Changes: - Modify scope validation to accept either classic PAT (repo scope) or fine-grained tokens (contents:read + pull_requests:write) - Document required scopes in pr-reviewer.md with fine-grained token requirements - Update pr-review-agent.md setup guide to recommend fine-grained tokens over classic PATs for better security (principle of least privilege) - Support both token types for backward compatibility This fixes PR #435 auth failure while improving security posture. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * chore: apply manual instructions [skip ci-relay] * chore: apply manual instructions [skip ci-relay] * fix: remove auto-merge to reduce token scope requirements The PR review agent no longer enables auto-merge, which eliminates the need for elevated repository permissions. This reduces the required token scopes from 'repo' (full control) or 'contents:write' to just the minimal permissions: - contents:read (read files and diffs) - pull_requests:write (post reviews) - members:read (optional, for escalation routing) Changes: - Remove auto-merge invocation from post-pr-review.sh - Update documentation to reflect review-only workflow (no auto-merge) - Simplify required token scopes in both agent and setup docs - PRs remain open for manual merge by authors/maintainers after approval This addresses the fine-grained token scope requirements raised in review comments while maintaining the core review functionality. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * fix(reviews): address review comments [skip ci-relay] --------- Co-authored-by: donpetry-bot <{}+donpetry-bot@users.noreply.github.com> Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com> Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>
don-petry
added a commit
that referenced
this pull request
Aug 8, 2026
* fix: support fine-grained tokens in pr-review scope validation The auth scope check was overly strict, requiring 'repo' scope (full repo control) even though the PR review agent only needs read/write access to specific resources. Changes: - Modify scope validation to accept either classic PAT (repo scope) or fine-grained tokens (contents:read + pull_requests:write) - Document required scopes in pr-reviewer.md with fine-grained token requirements - Update pr-review-agent.md setup guide to recommend fine-grained tokens over classic PATs for better security (principle of least privilege) - Support both token types for backward compatibility This fixes PR #435 auth failure while improving security posture. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * chore: apply manual instructions [skip ci-relay] * chore: apply manual instructions [skip ci-relay] * fix: remove auto-merge to reduce token scope requirements The PR review agent no longer enables auto-merge, which eliminates the need for elevated repository permissions. This reduces the required token scopes from 'repo' (full control) or 'contents:write' to just the minimal permissions: - contents:read (read files and diffs) - pull_requests:write (post reviews) - members:read (optional, for escalation routing) Changes: - Remove auto-merge invocation from post-pr-review.sh - Update documentation to reflect review-only workflow (no auto-merge) - Simplify required token scopes in both agent and setup docs - PRs remain open for manual merge by authors/maintainers after approval This addresses the fine-grained token scope requirements raised in review comments while maintaining the core review functionality. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * fix(reviews): address review comments [skip ci-relay] --------- Co-authored-by: donpetry-bot <{}+donpetry-bot@users.noreply.github.com> Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com> Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>
don-petry
added a commit
that referenced
this pull request
Aug 8, 2026
* fix: support fine-grained tokens in pr-review scope validation The auth scope check was overly strict, requiring 'repo' scope (full repo control) even though the PR review agent only needs read/write access to specific resources. Changes: - Modify scope validation to accept either classic PAT (repo scope) or fine-grained tokens (contents:read + pull_requests:write) - Document required scopes in pr-reviewer.md with fine-grained token requirements - Update pr-review-agent.md setup guide to recommend fine-grained tokens over classic PATs for better security (principle of least privilege) - Support both token types for backward compatibility This fixes PR #435 auth failure while improving security posture. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * chore: apply manual instructions [skip ci-relay] * chore: apply manual instructions [skip ci-relay] * fix: remove auto-merge to reduce token scope requirements The PR review agent no longer enables auto-merge, which eliminates the need for elevated repository permissions. This reduces the required token scopes from 'repo' (full control) or 'contents:write' to just the minimal permissions: - contents:read (read files and diffs) - pull_requests:write (post reviews) - members:read (optional, for escalation routing) Changes: - Remove auto-merge invocation from post-pr-review.sh - Update documentation to reflect review-only workflow (no auto-merge) - Simplify required token scopes in both agent and setup docs - PRs remain open for manual merge by authors/maintainers after approval This addresses the fine-grained token scope requirements raised in review comments while maintaining the core review functionality. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * fix(reviews): address review comments [skip ci-relay] --------- Co-authored-by: donpetry-bot <{}+donpetry-bot@users.noreply.github.com> Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com> Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fix auth scope validation to support fine-grained GitHub tokens alongside classic PATs.
Problem
PR #353 added strict auth scope validation requiring the
reposcope (full repository control), which breaks workflows using fine-grained tokens with minimal permissions.Solution
reposcope) or fine-grained tokens (contents:read+pull_requests:write)Changes
.github/workflows/pr-review.yml: Flexible scope validation with clear error messagesagents/pr-reviewer.md: Add required scopes documentationdocs/pr-review-agent/pr-review-agent.md: Update setup guide with both token optionsRef #435 (note: original
Closes #435was an erroneous keyword — #435 is an unrelated PR and has been reopened)🤖 Generated with Claude Code
Summary by CodeRabbit
Documentation
Chores