From 8d67c40939bed439a968b44185dd1b06df40619a Mon Sep 17 00:00:00 2001
From: Peter Steinberger <steipete@gmail.com>
Date: Fri, 24 Jul 2026 06:21:04 -0700
Subject: [PATCH] fix(ci): restore full-grant app token for pr-ci-sweeper

Every scheduled sweep failed at token minting since the explicit
permission subset was added: actions/create-github-app-token rejects any
request exceeding the installation grant, and these installations lack
actions:write/checks:read (stale.yml succeeds with actions:read;
auto-response succeeds with neither). Requesting no subset restores the
app's full granted set, which the re-fire lane demonstrably worked with.
If the org later grants actions:write+checks:read, the explicit subset
can return.
---
 .github/workflows/pr-ci-sweeper.yml | 13 +++++--------
 1 file changed, 5 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/pr-ci-sweeper.yml b/.github/workflows/pr-ci-sweeper.yml
index 85a27e6e610d..6d2610e317f2 100644
--- a/.github/workflows/pr-ci-sweeper.yml
+++ b/.github/workflows/pr-ci-sweeper.yml
@@ -34,26 +34,23 @@ jobs:
         with:
           ref: ${{ github.sha }}
           persist-credentials: false
+      # No permission-* subset here: requesting a permission the installation
+      # does not grant fails token minting outright, and these installations
+      # lack actions:write/checks:read (every sweep failed 2026-07-24 until the
+      # subset was reverted). No inputs = the app's full granted set, which the
+      # sweep's re-fire lane is known to work with.
       - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
         id: app-token
         continue-on-error: true
         with:
           app-id: "2729701"
           private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
-          permission-actions: write
-          permission-checks: read
-          permission-issues: write
-          permission-pull-requests: write
       - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
         id: app-token-fallback
         if: steps.app-token.outcome == 'failure'
         with:
           app-id: "2971289"
           private-key: ${{ secrets.GH_APP_PRIVATE_KEY_FALLBACK }}
-          permission-actions: write
-          permission-checks: read
-          permission-issues: write
-          permission-pull-requests: write
       - name: Sweep dropped PR CI runs
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
         with: