ewilliams28/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-08-12 21:53:00 -06:00
Code Issues Packages Projects Releases Wiki Activity

fix(ci): restore full-grant app token for pr-ci-sweeper

Browse Source 
Every scheduled sweep failed at token minting since the explicit
permission subset was added: actions/create-github-app-token rejects any
request exceeding the installation grant, and these installations lack
actions:write/checks:read (stale.yml succeeds with actions:read;
auto-response succeeds with neither). Requesting no subset restores the
app's full granted set, which the re-fire lane demonstrably worked with.
If the org later grants actions:write+checks:read, the explicit subset
can return.
This commit is contained in:
Peter Steinberger
2026-07-24 06:21:04 -07:00
parent ebf2306c1d
commit 8d67c40939
1 changed files with 5 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/pr-ci-sweeper.yml
+5 -8
View File
@@ -34,26 +34,23 @@ jobs:
with:
ref: ${{ github.sha }}
persist-credentials: false
# No permission-* subset here: requesting a permission the installation
# does not grant fails token minting outright, and these installations
# lack actions:write/checks:read (every sweep failed 2026-07-24 until the
# subset was reverted). No inputs = the app's full granted set, which the
# sweep's re-fire lane is known to work with.
- uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
id: app-token
continue-on-error: true
with:
app-id: "2729701"
private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
permission-actions: write
permission-checks: read
permission-issues: write
permission-pull-requests: write
- uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
id: app-token-fallback
if: steps.app-token.outcome == 'failure'
with:
app-id: "2971289"
private-key: ${{ secrets.GH_APP_PRIVATE_KEY_FALLBACK }}
permission-actions: write
permission-checks: read
permission-issues: write
permission-pull-requests: write
- name: Sweep dropped PR CI runs
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
with: