From dac55e75f4a728625bd1019c70bf8a5bda014d06 Mon Sep 17 00:00:00 2001 From: Loup-Garou911XD <90267658+Loup-Garou911XD@users.noreply.github.com> Date: Mon, 28 Sep 2026 16:06:09 +0530 Subject: [PATCH] ci: grant PR Apply the statuses:write scope it needs The "Report metadata fixpoint status" step added in dcb50fd posts a commit status via `gh api --method POST repos/{repo}/statuses/{sha}`, but the permissions block was never extended to cover it. `statuses` is its own scope and `contents: write` does not imply it, so with the block declared the scope defaulted to `none` and every POST returned: gh: Resource not accessible by integration (HTTP 403) The step then exited 1, which tripped the `if: failure()` notifier into commenting "Automatic formatting/metadata could not be applied to this PR (patch touched a disallowed path, or a conflict occurred)" on PRs whose patch had in fact applied cleanly. On PR #494 both apply steps reported success and pushed nothing, i.e. the branch was already at the fixpoint and the step was about to report success, yet the contributor was told the opposite. Because the status never posted, `metadata-fixpoint` has not been set once since it was introduced, so as a required check on main it blocks every PR. Co-authored-by: Loup --- .github/workflows/ci-apply.yml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.github/workflows/ci-apply.yml b/.github/workflows/ci-apply.yml index 5d1e9ef2..7b146c03 100644 --- a/.github/workflows/ci-apply.yml +++ b/.github/workflows/ci-apply.yml @@ -45,6 +45,13 @@ permissions: contents: write pull-requests: write actions: read # required to download an artifact from another workflow run + # Required by the "Report metadata fixpoint status" step below. `statuses` + # is its own scope: `contents: write` does NOT imply it, and once a + # permissions block is declared every unlisted scope is `none`. Without + # this the status POST 403s, that step exits 1, and the `if: failure()` + # step comments "patch touched a disallowed path, or a conflict occurred" + # on a PR where the patch applied perfectly. + statuses: write concurrency: group: pr-apply-${{ github.event.workflow_run.head_repository.full_name }}-${{ github.event.workflow_run.head_branch }}