From 68dffbb322ca95b56f2ba89051a6e0d8eb1c7a3c Mon Sep 17 00:00:00 2001 From: Samuel Newman Date: Mon, 29 Jun 2026 15:24:12 +0300 Subject: [PATCH] fix(ci): grant workflows permission for internal sync push The sync syncs files under .github/workflows/, which GitHub refuses to push from a GitHub App token that lacks the workflows permission. Add permission-workflows: write to the scoped app token. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/sync-internal.yaml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/sync-internal.yaml b/.github/workflows/sync-internal.yaml index fd7fb89893..211bd7c806 100644 --- a/.github/workflows/sync-internal.yaml +++ b/.github/workflows/sync-internal.yaml @@ -28,8 +28,11 @@ jobs: private-key: ${{ secrets.SYNC_INTERNAL_PK }} repositories: social-app-internal # Scope the token down from the app's full installation permissions; - # pushing is the only thing this token is used for + # pushing is the only thing this token is used for. The workflows + # permission is required because the sync includes files under + # .github/workflows/, which GitHub refuses to push without it. permission-contents: write + permission-workflows: write - name: Push to internal repo env: TOKEN: ${{ steps.app-token.outputs.token }}