From f6cc2aee922bb34a2d9f698c32273f162f224ff6 Mon Sep 17 00:00:00 2001
From: Neil <4138956+nwparker@users.noreply.github.com>
Date: Fri, 1 May 2026 20:24:41 -0700
Subject: [PATCH] fix(release): grant actions:write + drop broken auto-merge on
 tap (#1336)

Two bugs surfaced on the v1.3.26 release:

1. release.yml's new `Trigger Homebrew cask bump` step failed with
   HTTP 403 "Resource not accessible by integration". The publish-release
   job's permissions block only listed `contents: write`, but
   POST /actions/workflows/:id/dispatches requires `actions: write` on the
   scoped-down GITHUB_TOKEN. Added the permission.

2. Even when the bump workflow does run, its `gh pr merge --auto` was
   silently no-op'ing against the homebrew-orca tap, leaving bump PRs
   open. `--auto` only activates when there's a required check or
   branch-protection rule to wait on; the tap intentionally has neither.
   Switched to a direct squash-merge so the tap stays hands-free as
   originally intended.

Co-authored-by: Orca <help@stably.ai>
---
 .github/workflows/homebrew-bump.yml | 8 +++++---
 .github/workflows/release.yml       | 5 +++++
 2 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/homebrew-bump.yml b/.github/workflows/homebrew-bump.yml
index 4a8adf7ce28..513e0ed36b0 100644
--- a/.github/workflows/homebrew-bump.yml
+++ b/.github/workflows/homebrew-bump.yml
@@ -150,6 +150,8 @@ jobs:
             --head "$branch" \
             || gh pr edit "$branch" --title "orca $VERSION"
 
-          # Why: auto-merge so the tap stays hands-free. Tap repo must have
-          # "Allow auto-merge" enabled in settings for this to take effect.
-          gh pr merge "$branch" --squash --auto --delete-branch || true
+          # Why: squash-merge immediately rather than --auto. The tap has no
+          # required checks or branch protection, and `gh pr merge --auto`
+          # only activates when there's something to wait on — on a repo
+          # with no gates it silently no-ops, leaving the PR open forever.
+          gh pr merge "$branch" --squash --delete-branch
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 87fd0ba92fe..8a43145319e 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -222,6 +222,11 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: write
+      # Why: actions:write is required for `gh workflow run homebrew-bump.yml`
+      # (below). Without it GITHUB_TOKEN gets HTTP 403 "Resource not accessible
+      # by integration" on POST /actions/workflows/:id/dispatches. The default
+      # scoped-down token grants only what the `permissions:` block lists.
+      actions: write
     steps:
       - name: Publish release
         # Why: derive `--prerelease` from the tag shape (not from whatever