starred/orca
1
0
Fork 0
mirror of https://github.com/stablyai/orca.git synced 2026-09-23 00:02:29 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(release): grant actions:write + drop broken auto-merge on tap (#1336)

Browse Source 
Two bugs surfaced on the v1.3.26 release:

1. release.yml's new `Trigger Homebrew cask bump` step failed with
   HTTP 403 "Resource not accessible by integration". The publish-release
   job's permissions block only listed `contents: write`, but
   POST /actions/workflows/:id/dispatches requires `actions: write` on the
   scoped-down GITHUB_TOKEN. Added the permission.

2. Even when the bump workflow does run, its `gh pr merge --auto` was
   silently no-op'ing against the homebrew-orca tap, leaving bump PRs
   open. `--auto` only activates when there's a required check or
   branch-protection rule to wait on; the tap intentionally has neither.
   Switched to a direct squash-merge so the tap stays hands-free as
   originally intended.

Co-authored-by: Orca <help@stably.ai>
This commit is contained in:
Neil
2026-05-01 20:24:41 -07:00
committed by GitHub
co-authored by Orca
parent dfee883f8a
commit f6cc2aee92
2 changed files with 10 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/homebrew-bump.yml
+5 -3
View File
@@ -150,6 +150,8 @@ jobs:
--head "$branch" \ --head "$branch" \
|| gh pr edit "$branch" --title "orca $VERSION" || gh pr edit "$branch" --title "orca $VERSION"
# Why: auto-merge so the tap stays hands-free. Tap repo must have # Why: squash-merge immediately rather than --auto. The tap has no
# "Allow auto-merge" enabled in settings for this to take effect. # required checks or branch protection, and `gh pr merge --auto`
gh pr merge "$branch" --squash --auto --delete-branch || true # only activates when there's something to wait on — on a repo
# with no gates it silently no-ops, leaving the PR open forever.
gh pr merge "$branch" --squash --delete-branch
.github/workflows/release.yml
+5
View File
@@ -222,6 +222,11 @@ jobs:
runs-on: ubuntu-latest runs-on: ubuntu-latest
permissions: permissions:
contents: write contents: write
# Why: actions:write is required for `gh workflow run homebrew-bump.yml`
# (below). Without it GITHUB_TOKEN gets HTTP 403 "Resource not accessible
# by integration" on POST /actions/workflows/:id/dispatches. The default
# scoped-down token grants only what the `permissions:` block lists.
actions: write
steps: steps:
- name: Publish release - name: Publish release
# Why: derive `--prerelease` from the tag shape (not from whatever # Why: derive `--prerelease` from the tag shape (not from whatever