From 5376c768677ddbe40f3a20eee8ec5e8a03f90767 Mon Sep 17 00:00:00 2001 From: Lucas Ramos <3140800+lucas-d-ramos@users.noreply.github.com> Date: Fri, 21 Aug 2026 11:53:20 +0200 Subject: [PATCH] docs: correct the claim that the App needs Workflows write v14.1.0 asserted that a GitHub App merging Dependabot's `github-actions` PRs needs Workflows (read/write), "not optional", because those PRs edit files under .github/workflows/. That is wrong. The workflows permission governs pushing workflow files through the Contents API. It does not gate merging a pull request that happens to change them. Verified against this org: app/github-actions is itself an App token and holds no workflows permission, yet has merged github-actions bumps in ci-workflows (#17, #18), bankimporter (#47, #51) and ecm (#33). The claim had already done damage: it propagated into the README and into the PR bodies for the auto-merge rollout, and it blocked an automated change to ak-visual-regression-tests, which correctly refused to proceed against documentation stating a required permission was absent. Co-Authored-By: Claude Opus 5 --- .github/workflows/dependabot-auto-merge.yml | 14 ++++++++++---- README.md | 8 ++++---- 2 files changed, 14 insertions(+), 8 deletions(-) diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml index d440934..1a789af 100644 --- a/.github/workflows/dependabot-auto-merge.yml +++ b/.github/workflows/dependabot-auto-merge.yml @@ -28,10 +28,16 @@ name: Dependabot auto-merge # back to GITHUB_TOKEN, so existing callers keep working unchanged — but any # caller that deploys on push wants the App. # -# The App needs three repository permissions: Contents (read/write), -# Pull requests (read/write), and Workflows (read/write). Workflows is easy to -# miss and not optional: Dependabot's `github-actions` PRs edit files under -# .github/workflows/, and a token without it is refused when merging them. +# The App needs two repository permissions: Contents (read/write) and +# Pull requests (read/write). Metadata (read) comes along mandatorily. +# +# It does NOT need Workflows (write), despite Dependabot's `github-actions` PRs +# editing files under .github/workflows/. That permission governs *pushing* +# workflow files through the Contents API, not *merging* a PR that changes them. +# Verified against this org on 2026-08-21: app/github-actions — itself an App +# token, with no workflows permission — has merged github-actions bumps in +# ci-workflows (#17, #18), bankimporter (#47, #51) and ecm (#33). An earlier +# revision of this comment claimed the opposite and was wrong. # --------------------------------------------------------------------------- on: diff --git a/README.md b/README.md index 2d6a492..5637d3d 100644 --- a/README.md +++ b/README.md @@ -185,10 +185,10 @@ immediately. nothing ships. Omit them and the workflow falls back to `GITHUB_TOKEN` and warns in the run log. - The App needs three repository permissions: **Contents** (read/write), **Pull requests** - (read/write) and **Workflows** (read/write). Workflows is easy to miss and not optional: - Dependabot's `github-actions` PRs edit files under `.github/workflows/`, and a token - without it is refused when merging them. + The App needs two repository permissions: **Contents** (read/write) and **Pull requests** + (read/write); Metadata (read) is mandatory and comes along. It does **not** need + Workflows (write) — that permission governs *pushing* workflow files through the Contents + API, not *merging* a PR that changes them. ### Sample usage