ci(winget): stop swallowing the fork-sync failure, and record the real cause - #118
Merged
Merged
Conversation
…l cause
The sync step was `continue-on-error: true`. The reasoning at the time was
"a sync hiccup must not block a submit that might still succeed" — but a
stale fork is the one thing that guarantees the submit will NOT succeed, so
the flag only ever hid the honest error and left the misleading one.
That is why the same failure was rediagnosed from scratch three releases
running. The full chain, verified this time:
WINGET_TOKEN lacks `workflow` scope
-> merge-upstream returns HTTP 422, because upstream winget-pkgs
contains .github/workflows/*.yml and syncing means writing them
-> the fork stays stale
-> the SUBMIT step reports "does not have the correct permissions
to execute CreateRef"
Nothing in that final message mentions the sync, the fork, or the scope.
So: drop continue-on-error, and correct the docs. CLAUDE.md said
"`public_repo` is sufficient" and "this is almost never a token problem" —
both written in good faith after v0.6.0, both wrong, and both actively
steered the v0.7.0 diagnosis away from the answer. It IS partly a token
problem; it just isn't the scope anyone reaches for first. Widening to full
`repo` remains the wrong fix and that warning stays.
No release behaviour changes for a correctly-scoped token.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NDsEfog5kVkT5NmX1Ya5be
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The fork-sync step in
winget.ymlwascontinue-on-error: true. That flag is why the same winget failure has been diagnosed from scratch three releases running — the sync failed silently every time, and the only error anyone ever saw was the misleading one from the submit step.The actual chain
Nothing in that final message mentions the sync, the fork, or the scope — which is exactly how it kept sending the investigation after the wrong thing.
Changes
continue-on-errorfrom the sync step. The original rationale ("a hiccup shouldn't block a submit that might still succeed") doesn't hold: a stale fork is the one condition that guarantees the submit will fail. Failing here surfaces the honest error instead of the confusing one.public_repoandworkflow— in the workflow header, at the sync step, and inCLAUDE.md.CLAUDE.md. It said "this is almost never a token problem" and "public_repois sufficient". Both were written in good faith after v0.6.0; both are wrong, and both steered the v0.7.0 diagnosis away from the answer. The warning against widening to fullrepostays — that remains the wrong fix.Risk
None for a correctly-scoped token:
merge-upstreamon an up-to-date fork returnsnone/"not behind" and exits 0. With a wrongly-scoped token the job now fails loudly at the step that is actually broken, which is the point.Not verifiable by re-dispatch right now without duplicating the open winget-pkgs#430424 for v0.7.0 — the real test is the v0.7.1 release.
🤖 Generated with Claude Code
https://claude.ai/code/session_01NDsEfog5kVkT5NmX1Ya5be