PR Review Agent — failures detected 2026-05-29

1. Executive Summary

Status: WARNING
Period: 2026-05-28T19:42:15Z – 2026-05-28T20:13:56Z
Result: 1 of 25 runs failed (4%) | 2 cancelled | 3 skipped

Key findings:

DON_PETRY_BOT_GH_PAT is a fine-grained PAT (github_pat_11…) — scope validation in the workflow assumes classic PAT format and always fails for fine-grained tokens
2 runs cancelled simultaneously (Budget breaker: wake it only when there is something to decide, instead of on every Dev-Lead Agent run #2306, fix(budget-breaker): lengthen the early exit's default slot from two minutes to ten #2307) despite cancel-in-progress: false — likely a queuing burst at 20:07:54Z with manual or runner-side cancellation
3 skipped runs are normal no-ops (no actionable PR in event payload); not a concern

Action required: Replace DON_PETRY_BOT_GH_PAT with a classic PAT that has repo and read:org scopes, or update the scope-check script to detect and bypass validation for fine-grained PATs.

2. Failure Breakdown

Failure Category	Affected Runs	Example Error Message
Missing token scope (classic PAT scope check vs fine-grained PAT)	#2291 (1 run)	`GH_TOKEN is missing required scope: repo`
Cancellation (burst concurrency)	#2306, #2307 (2 runs)	(no error — runner cancelled before steps executed)

3. Error Patterns

Category: Missing token scope

Exact error from logs (run #2291, "Install review engine CLIs" step):

✓ Logged in to github.com account donpetry-bot (GH_TOKEN)
- Active account: true
- Git operations protocol: https
- Token: github_pat_11CDFSYKQ0w50IHawIgb0w_***

##[error]GH_TOKEN is missing required scope: repo
##[error]Process completed with exit code 1.

Step: "Install review engine CLIs" (the inline gh auth status + scope validation block)

Root cause: The token prefix github_pat_11… identifies DON_PETRY_BOT_GH_PAT as a fine-grained PAT. Fine-grained PATs do not expose an OAuth scope list — gh auth status omits the Token scopes: line entirely for these tokens. The scope-validation script greps for Token scopes: → finds nothing → normalized_scopes is empty → the grep -qE check for repo and read:org fails → exits 1. The token may have adequate repository permissions under the fine-grained model, but the check cannot see them.

The failure is isolated to run #2291, which reviewed PR #353. That PR modifies the workflow itself; since pull_request / synchronize events on same-repo PRs run the workflow from the PR's merge commit, run #2291 executed the new scope-validation code introduced by PR #353 — not the main-branch version shown in the prompt. All other concurrent runs used the main-branch workflow (without that check) and succeeded.

4. Token Scope Analysis

Item	Detail
Token type	Fine-grained PAT (`github_pat_11…`)
Scopes visible to `gh auth status`	(none — fine-grained PATs do not surface OAuth scope strings)
Scopes required by workflow scope check	`repo`, `read:org`
Scopes confirmed present (from `gh auth status` output)	Authenticated account only — no scope list
Workflow-declared GitHub token permissions	`contents: read`, `pull-requests: write`, `checks: read`

Per-scope recommendation:

Required Scope	Status	Recommendation
`repo`	Cannot be verified on fine-grained PAT	Either switch to a classic PAT with `repo` scope, or add a fine-grained PAT detection branch (`if [[ "$token" == github_pat_11* ]]; then skip_scope_check; fi`)
`read:org`	Cannot be verified on fine-grained PAT	Same as above — `read:org` is also a classic-PAT scope; fine-grained equivalent is the "Organization members: Read" permission granted during token creation

5. Recommendations

Replace or re-create DON_PETRY_BOT_GH_PAT as a classic PAT with repo and read:org scopes
- What: Go to donpetry-bot account settings → Developer settings → Personal access tokens → Tokens (classic). Create a new token with at minimum repo (full) and read:org. Update the DON_PETRY_BOT_GH_PAT Actions secret in petry-projects/.github-private.
- Why: The scope-validation script introduced in PR PR Review Agent: make failure runs diagnosable and harden transient setup failures #353 is written for classic PATs. Fine-grained PATs are structurally incompatible with OAuth scope strings.
- Expected impact: Eliminates the false-positive scope failure entirely.
- Urgency: CRITICAL — any future event on a PR that touches the workflow will re-trigger this failure.
Guard the scope check against fine-grained PATs (defensive fix, keep regardless of token type)
- What: In the scope-validation block of pr-review.yml (the Install review engine CLIs step), add a short-circuit before the scope loop:
```
if [[ "$token_line" == *"github_pat_11"* ]]; then
  echo "::notice::Fine-grained PAT detected — skipping classic scope check"
else
  # existing repo / read:org loop
fi
```
- Why: Fine-grained PATs are increasingly common; this prevents the check from being a footgun if the token type ever changes again.
- Expected impact: Future fine-grained PAT rotations will not break the workflow.
- Urgency: HIGH
Investigate the 2 cancelled runs (Budget breaker: wake it only when there is something to decide, instead of on every Dev-Lead Agent run #2306, fix(budget-breaker): lengthen the early exit's default slot from two minutes to ten #2307 at 20:07:54Z)
- What: Review the Actions run history for what triggered those three near-simultaneous runs. If they were redundant event firings (e.g., multiple check_suite events for the same PR), consider whether the concurrency group expression correctly deduplicates by PR URL for check_suite events (note: check_suite events expose url, not html_url, which is already handled in the group expression — verify the two cancelled runs had the same group key).
- Why: cancel-in-progress: false should protect in-progress runs; if they were queued and then manually or externally cancelled, this is a one-off. If it's reproducible, there may be a concurrency group key collision.
- Expected impact: Reduces unnecessary runner spin-up and wasted queue slots.
- Urgency: LOW

6. Health Score

Health: 8/10 — One isolated failure caused by a fine-grained PAT incompatibility with a newly introduced classic-PAT scope check; all other runs healthy, no systemic outage.

Dev-Lead Implementation Plan

Issue: #407 — PR Review Agent — failures detected 2026-05-29

Scope

Extract the inline Verify auth scopes logic in pr-review.yml into a standalone script (scripts/verify-auth-scopes.sh), add an explicit github_pat_ prefix check as the first guard for fine-grained PATs, and cover the behavior with bats unit tests.

Implementation Checklist

tests/test_verify_auth_scopes.bats — new bats test file (TDD: written first, failing)
scripts/verify-auth-scopes.sh — extracted + enhanced scope validation with github_pat_ prefix guard
.github/workflows/pr-review.yml — replace inline step body with bash scripts/verify-auth-scopes.sh
.github/workflows/lint.yml — add tests/test_verify_auth_scopes.bats to the bats runner

Tests to Write

Fine-grained PAT (github_pat_11… prefix) → exits 0, emits ::notice::
Fine-grained PAT with no Token scopes: line (empty normalized_scopes) → exits 0, emits ::warning::
Classic PAT with repo + read:org → exits 0
Classic PAT with repo but missing read:org → exits 1 with error
Classic PAT with contents + pull_requests (no repo) → exits 0
Classic PAT missing contents → exits 1 with error
gh auth status command fails → exits non-zero
Auth status contains "cannot determine" → exits 0, emits ::warning::

Test Command

bats tests/test_verify_auth_scopes.bats

Dev-Lead: Implementation Complete

Plan Execution

Wrote failing bats tests (tests/test_verify_auth_scopes.bats) before implementation — 11 tests, all red
Created scripts/verify-auth-scopes.sh with github_pat_ prefix check as primary guard, plus fallback empty-scopes / "cannot determine" check — all 11 tests turned green
Updated .github/workflows/pr-review.yml: replaced 41-line inline step body with bash scripts/verify-auth-scopes.sh
Updated .github/workflows/lint.yml: added tests/test_verify_auth_scopes.bats to the bats runner so CI gates the new tests
bash scripts/dev-lead-lint.sh — all shellcheck and agent profile checks passed

Test Results

1..11
ok 1 fine-grained PAT (github_pat_11 prefix) exits 0 with notice
ok 2 fine-grained PAT notice does not contain ::error::
ok 3 token with no Token scopes line exits 0 with warning
ok 4 auth status with 'cannot determine' in output exits 0 with warning
ok 5 classic PAT with repo and read:org exits 0
ok 6 classic PAT with repo but missing read:org exits 1
ok 7 classic PAT missing read:org emits actionable error guidance
ok 8 classic PAT with contents and pull_requests exits 0
ok 9 classic PAT missing contents scope exits 1
ok 10 classic PAT missing pull_requests scope exits 1
ok 11 gh auth status failure exits non-zero

Files Changed

scripts/verify-auth-scopes.sh (new): extracted scope validation logic; adds explicit github_pat_ prefix guard as the first check before the existing empty-scopes / keyword fallback
.github/workflows/pr-review.yml: Verify auth scopes step now calls bash scripts/verify-auth-scopes.sh (no behavior change for classic PATs; fine-grained PATs now hit the prefix guard first)
tests/test_verify_auth_scopes.bats (new): 11 behavioral bats tests covering all code paths
.github/workflows/lint.yml: new test file added to bats CI job

Notes

Recommendation test issue from agent #1 (replace DON_PETRY_BOT_GH_PAT with a classic PAT) requires admin action and cannot be done in code — left for a human operator.
Recommendation Add @claude delegation, auto-merge, and rebase handling #3 (investigate cancelled runs Budget breaker: wake it only when there is something to decide, instead of on every Dev-Lead Agent run #2306/fix(budget-breaker): lengthen the early exit's default slot from two minutes to ten #2307) was LOW urgency and investigation-only; no code change needed per the issue.
The github_pat_ prefix check (vs the issue's narrower github_pat_11) is intentionally broader to handle future fine-grained PAT formats without requiring another fix.
Extracting the logic to scripts/verify-auth-scopes.sh enables proper TDD and follows the existing pattern (scripts for logic, workflows as thin callers).

feat: implement issue #407 — PR Review Agent — failures detected 2026…

Navigation Menu

Repository navigation

PR Review Agent — failures detected 2026-05-29 #407

1. Executive Summary

2. Failure Breakdown

3. Error Patterns

4. Token Scope Analysis

5. Recommendations

6. Health Score

Dev-Lead Implementation Plan

Scope

Implementation Checklist

Tests to Write

Test Command

Dev-Lead: Implementation Complete

Plan Execution

Test Results

Files Changed

Notes

7 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

PR Review Agent — failures detected 2026-05-29 #407

Description

1. Executive Summary

2. Failure Breakdown

3. Error Patterns

4. Token Scope Analysis

5. Recommendations

6. Health Score

Activity

don-petry commented on Jun 8, 2026

Dev-Lead Implementation Plan

Scope

Implementation Checklist

Tests to Write

Test Command

don-petry commented on Jun 8, 2026

Dev-Lead: Implementation Complete

Plan Execution

Test Results

Files Changed

Notes

7 remaining items

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions