[imanimanyara]

Summary

refresh-bot was granted checks: read and statuses: read on 2026-11-03, and all 10 owned orgs approved them, so the policy ceiling can now move with the app.

before  contents=write metadata=read pull_requests=write                    (3)
after   + checks=read statuses=read                                          (5)

Why this is a separate change from the grant

A ceiling that claims a permission the app does not hold makes create-github-app-token answer 422 on every run. So the order is: grant on the app → every org approves → widen the ceiling. bot/README.md's "Adding a job" step says exactly this; this is the first time it has been exercised.

dependabot-merge gets the two reads back. merge.py reads commits/{sha}/check-runs and commits/{sha}/status; without them decide() sees no checks and refuses every pull request — fail-closed, but useless.

workflows: write is still absent, and must stay absent

This app's key is an organisation-level secret, so that permission would be within reach of every workflow in the estate — letting a release job rewrite the CI that gates it. A Dependabot pull request touching .github/workflows/ is therefore never merged by this token; those go to @dependabot merge, which Dependabot performs with its own credentials.

Verification

• 24 tests pass. CeilingMatchesTheAppTest still refuses workflows, issues, administration, members and secrets by name, and was re-proven red: planting workflows: write in the ceiling fails 6 tests, reverting goes green.
• bot/resolve.py --job dependabot-merge --owner laranail now emits contents=write pull-requests=write checks=read statuses=read.
• .github/actions/bot-token/action.yml passes exactly the ceiling (a ceiling permission the action does not pass is silently dropped — test_the_action_passes_exactly_the_ceiling covers it).
• Both workflows parse; jobs unchanged.

Not changed

The gate stays dry-run: it acts only where DEPENDABOT_MERGE_APPLY is true, and no repository variable sets it. gh api repos/simtabi/.github/actions/variables returns none, so it has never merged anything.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.