Repository navigation
fix(ci): PublishRelease could not read its own PRs — grant pull-requests: read - #31
Merged
Merged
Conversation
…ests: read`
`Publish Release` dies at `Build release notes` on every tag:
gh pr list --repo … --search 'merged:>…' --json number,title,author,body,…
GraphQL: Resource not accessible by integration (search.nodes.0)
`build_release_notes.py` resolves that over the GraphQL search connection, which needs
`pull-requests: read`. This repo wrote the block in FLOW style — `permissions: { contents: write }`
— which is the same statement and has the same consequence: a `permissions:` mapping is a
REPLACEMENT, not an addition, so every unlisted scope is `none` and the job had no read access to
pull requests at all. Rewritten as a block mapping so the reason can be stated next to the scope.
The failure is invisible from the releases page: the release is created anyway, and what it carries
is the Release Drafter's accumulated body, never overwritten because `gh release edit --notes-file`
is the step AFTER the one that dies. Measured on FunctionMeasures.jl, where this was found: every
release shipped all 126–130 PRs ever merged, growing by one entry per release.
Last of the fleet sweep; ComplexAnalysis.jl, ParaLinearAlgebra.jl and ParameterizedITensor.jl
already had it, the other 14 were fixed alongside this one.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Contributor
|
📚 Docs preview: https://codes.sota-shimozono.com/ParamIO.jl/previews/PR31/ (updates on each push to this PR) |
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes the
Resource not accessible by integration (search.nodes.0)failure that killsPublish ReleaseatBuild release noteson every tag.build_release_notes.pyreads merged PRs throughgh pr list --search, which resolves over the GraphQL search connection and needspull-requests: read. This repo wrote the block in flow style (permissions: { contents: write }) — same statement, same consequence: apermissions:mapping is a replacement, not an addition, so every unlisted scope isnone. Rewritten as a block mapping so the reason sits next to the scope.Why it survived unnoticed: the release is created anyway. What it carries is the Release Drafter's accumulated body, never overwritten because
gh release edit --notes-fileis the step after the one that dies. Measured on FunctionMeasures.jl: every release shipped all 126–130 PRs ever merged.Last of the fleet sweep — 15 repos fixed today, 3 already had it.