From b0371715934efe463d4a6346b9d0d8f69d5fc1e1 Mon Sep 17 00:00:00 2001 From: Youichi Fujimoto Date: Tue, 11 Aug 2026 11:56:46 +0900 Subject: [PATCH] ci(ai-review): grant contents: write so the AI review can start MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The reusable workflow now resolves review threads it has verified as fixed, in a dedicated job holding `contents: write` — the permission GitHub actually gates `resolveReviewThread` on. A called workflow may only narrow the permissions it inherits, so a job asking for more than the caller granted is not a degraded feature: it is a `startup_failure` that stops the whole review from running. That is what has been happening here since fpt/klein-cli#112 merged. Granting the ceiling here fixes it. Nothing writes to this repository — inside the reusable workflow the job that checks out and runs this repo's PR code is narrowed straight back to `contents: read`, and only the mutation-only job, which checks nothing out, keeps the write scope. Upstream: fpt/klein-cli#111 Co-Authored-By: Claude Opus 5 --- .github/workflows/ai-review.yml | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ai-review.yml b/.github/workflows/ai-review.yml index b839674..9662a8e 100644 --- a/.github/workflows/ai-review.yml +++ b/.github/workflows/ai-review.yml @@ -10,8 +10,16 @@ on: pull_request: types: [opened, synchronize, reopened, ready_for_review] +# `contents: write` is not used to push anything — the review writes no code. +# GitHub gates the `resolveReviewThread` GraphQL mutation on it (not on +# `pull-requests: write`, as one would expect), and the reusable workflow now +# resolves threads the reviewer has verified as fixed. It has to be granted +# here because a reusable workflow can only narrow the permissions it inherits; +# inside it, the job that checks out and runs this PR's code is narrowed back +# to `contents: read`, so no job holds both a write token and PR-authored code. +# See fpt/klein-cli#111. permissions: - contents: read + contents: write pull-requests: write jobs: