Skip to content

docs: correct the claim that the App needs Workflows write #22

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
lucas-d-ramos merged 1 commit into from
Aug 21, 2026
Merged

docs: correct the claim that the App needs Workflows write #22

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 10 additions & 4 deletions .github/workflows/dependabot-auto-merge.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,10 +28,16 @@ name: Dependabot auto-merge
# back to GITHUB_TOKEN, so existing callers keep working unchanged — but any
# caller that deploys on push wants the App.
#
# The App needs three repository permissions: Contents (read/write),
# Pull requests (read/write), and Workflows (read/write). Workflows is easy to
# miss and not optional: Dependabot's `github-actions` PRs edit files under
# .github/workflows/, and a token without it is refused when merging them.
# The App needs two repository permissions: Contents (read/write) and
# Pull requests (read/write). Metadata (read) comes along mandatorily.
#
# It does NOT need Workflows (write), despite Dependabot's `github-actions` PRs
# editing files under .github/workflows/. That permission governs *pushing*
# workflow files through the Contents API, not *merging* a PR that changes them.
# Verified against this org on 2026-08-21: app/github-actions — itself an App
# token, with no workflows permission — has merged github-actions bumps in
# ci-workflows (#17, #18), bankimporter (#47, #51) and ecm (#33). An earlier
# revision of this comment claimed the opposite and was wrong.
# ---------------------------------------------------------------------------

on:
Expand Down
8 changes: 4 additions & 4 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -185,10 +185,10 @@ immediately.
nothing ships. Omit them and the workflow falls back to `GITHUB_TOKEN` and warns in the
run log.

The App needs three repository permissions: **Contents** (read/write), **Pull requests**
(read/write) and **Workflows** (read/write). Workflows is easy to miss and not optional:
Dependabot's `github-actions` PRs edit files under `.github/workflows/`, and a token
without it is refused when merging them.
The App needs two repository permissions: **Contents** (read/write) and **Pull requests**
(read/write); Metadata (read) is mandatory and comes along. It does **not** need
Workflows (write) — that permission governs *pushing* workflow files through the Contents
API, not *merging* a PR that changes them.

### Sample usage

Expand Down