docs(release): template-sync App needs Workflows write permission - #294
Merged
Conversation
The deploy-template mirror includes .github/workflows/build.yml, and GitHub rejects an App push that creates or updates any file under .github/workflows/ without the Workflows permission. An App with Contents-only write syncs fine until a workflow file changes, then fails the whole push — which is what broke templates:sync when build.yml changed. Document that the App needs both Contents and Workflows read/write, and to approve the added permission on the installation. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MNjDm3zR8M4HMyixCVgHwP
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The 0.26.1 release's
templates:syncstep failed:The deploy-template mirror includes
.github/workflows/build.yml, and GitHub rejects a GitHub App push that creates or updates any file under.github/workflows/unless the App has the Workflows permission. TheTEMPLATE_SYNCApp was set up withContents: read and writeonly, so it synced every file fine — until a workflow file actually changed (the quick-start split updatedbuild.ymlto buildDockerfile.prebuilt), and then the whole push was rejected.What
Documents in
docs/contributing/release.mdthat the App needs Contents and Workflows read/write, and to approve the added permission on the installation.No
release.ymlchange is needed: itscreate-github-app-tokenstep passes nopermission-*inputs, so the minted token already carries every permission the App holds — granting the App the Workflows permission is sufficient.The operational fix (outside this PR)
Grant the
TEMPLATE_SYNCApp the Workflows: Read and write permission, approve it on the installation formeith-dev/templateandmeith-dev/vercel-template, then re-run the failedpublish-templatesjob. Until then the template repos stay a release behind and the "Deploy template repositories are in sync" check stays red.🤖 Generated with Claude Code
Generated by Claude Code