docs: correct the claim that the App needs Workflows write - #22
Merged
Conversation
v14.1.0 asserted that a GitHub App merging Dependabot's `github-actions` PRs needs Workflows (read/write), "not optional", because those PRs edit files under .github/workflows/. That is wrong. The workflows permission governs pushing workflow files through the Contents API. It does not gate merging a pull request that happens to change them. Verified against this org: app/github-actions is itself an App token and holds no workflows permission, yet has merged github-actions bumps in ci-workflows (#17, #18), bankimporter (#47, #51) and ecm (#33). The claim had already done damage: it propagated into the README and into the PR bodies for the auto-merge rollout, and it blocked an automated change to ak-visual-regression-tests, which correctly refused to proceed against documentation stating a required permission was absent. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
v14.1.0 shipped an incorrect claim and it has already caused a problem.
The wrong claim
The reusable's header and the README both stated the App needs Workflows
(read/write), "not optional", because Dependabot's
github-actionsPRs editfiles under
.github/workflows/.Why it is wrong
The
workflowspermission governs pushing workflow files through theContents API. It does not gate merging a pull request that changes them.
Verified against this org —
app/github-actionsis itself an App token andholds no
workflowspermission, yet has merged:docker/login-action)docker/login-action)astral-sh/setup-uv)All are
github-actionsbumps that modify.github/workflows/.Why it matters
The claim propagated into the README and into the PR bodies of the auto-merge
rollout, and it blocked an automated change to ak-visual-regression-tests:
the agent checked the App's actual permissions, found no
workflows, read thiscomment saying it was required, and correctly refused to proceed.
It would also have caused an unnecessary permission grant —
workflows: writelets a token rewrite CI definitions across every installed repo, which is not a
permission to hand out on a false premise.
Change
Documentation only. No behaviour change, so no version bump is required — the
floating
v14can pick this up on the next release.🤖 Generated with Claude Code