[imanimanyara]

Summary

Refresh Bot is being retired. bot/policy.json named only the three jobs that run from this repository, so the other 37 workflow files in the estate had no job to ask for. These five cover all of them:

Job	Owners	Permissions	Covers
release-pr	*	contents, pull-requests (write)	release-please ×18, sync-upstream ×4, rebuild-bundle, visual-baselines ×2, tzdata-bump, refresh, refresh-pins ×2
estate-read	*	contents, pull-requests (read)	ichava estate-check, laranail audit-private-default-branches
private-dep-read	simtabi	contents (read), sis-sdk + docsmith	laranail/sis-wrapper ×3 and the reusable tests.yml; docsmith-scaffolder
consumer-read	ichava	contents (read), icon-browser + ichava.com	react-icon-browser, react-landingpage check:consumers
package-repo-push	simtabi	contents, pull-requests (write), homebrew-tap + scoop-bucket	simtabi/osaat GoReleaser

The permissions are not copied from the ceiling, and that is the point

Measured today with gh api apps/<slug> --jq .permissions:

refresh-bot   contents=write metadata=read pull_requests=write
simtabi-bot   checks=read contents=write issues=write metadata=read
              pull_requests=write statuses=read workflows=write

Refresh Bot is the narrower app. So replacing it with simtabi-bot is only a narrowing if each replacement job asks for no more than Refresh Bot ever had — and nothing but a test keeps that true once these jobs are reachable.

RefreshBotReplacementTest asserts it per job. The one that matters is release-pr: it is owners: "*", reachable for every managed org, and it must never carry workflows: write or a release job could rewrite the CI that gates it.

Verification

• 23 tests pass (python3 -m unittest discover -s bot/tests), up from 17.
• The new guard was proven red before being trusted: planting workflows: write on release-pr fails 2 tests; reverting goes green. That permission is inside simtabi-bot's ceiling, so the policy still loads — the assertion is the only thing standing between that and an org-reachable token that can rewrite workflows.
• Every new job resolved through bot/resolve.py; the three narrowed ones refuse an owner they do not name, with a positive control on the owner they do.

Not in this change

No workflow is re-pointed yet. simtabi-bot's private key lives in one environment on this repository, so no other repository can mint its tokens — moving the 37 files needs that resolved first, and it is a decision rather than a patch. These definitions are correct either way.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.