[Fleet Monitor] petry-projects/TalkTerm — apply-repo-settings.yml

🔴 CRITICAL: `petry-projects/TalkTerm` / `apply-repo-settings.yml`

Metric	Value
Failure Rate	100% (5 / 5 runs)
Status	CRITICAL
p50 Duration	0s
p95 Duration	0s
Successful Runs	0
Cancelled Runs	0

Workflow: apply-repo-settings.yml

Last updated by Fleet Monitor run on 2026-06-10.
Threshold: failure rate > 10% over the monitored window.

Dev-Lead Implementation Plan

Issue: #199 — [Fleet Monitor] petry-projects/TalkTerm — apply-repo-settings.yml

Root Cause

administration: write is not a valid GITHUB_TOKEN permission scope in GitHub Actions workflows (it exists only for fine-grained PATs, not for the built-in GITHUB_TOKEN). When GitHub encounters this unknown permission key, it rejects the job before it starts — producing jobs: [] and a 0-second run duration, exactly matching the observed 100% failure rate.

Evidence: every run shows "jobs":[] in the GitHub API, start/end timestamps are identical, and actions/checkout SHA is confirmed correct.

Secondary finding: the check-suites/preferences API endpoint requires a classic PAT with repo scope — OAuth/App tokens are rejected. GITHUB_TOKEN would be rejected here even if the permission issue were resolved.

The repo already has GH_PAT_WORKFLOWS (a classic PAT) configured as a secret, which satisfies both API requirements.

Scope

Replace the invalid administration: write permission with contents: read (needed for checkout) and switch the API token from GITHUB_TOKEN to GH_PAT_WORKFLOWS so the gh api calls in the script can authenticate with admin scope.

Implementation Checklist

.github/workflows/apply-repo-settings.yml: replace administration: write → contents: read, switch GH_TOKEN to secrets.GH_PAT_WORKFLOWS, update header comment

Tests to Write

N/A — pure CI configuration change (no observable application behaviour to test). Exception applies per Phase 2 rule: "For pure documentation, configuration, or behaviour-preserving refactors with no observable behavioural change, skip this phase."
Dev-lead lint (bash .dev-lead/scripts/dev-lead-lint.sh) will be run as the verification gate.

Test Command

bash .dev-lead/scripts/dev-lead-lint.sh

Dev-Lead: Implementation Complete

Root Cause

administration: write is not a valid GITHUB_TOKEN permission scope in GitHub Actions. It exists only for fine-grained personal access tokens, not for the built-in workflow token. When GitHub encounters this unknown permission key in a job's permissions: block it rejects the job before it starts, producing jobs: [] and a 0-second run duration — exactly the observed 100% failure / 0s p50 pattern.

Confirmed via gh api …/actions/runs/<id> returning "jobs":[] for every run, including the run on main (run 27109003401).

A second blocker exists independently: the check-suites/preferences PATCH endpoint rejects OAuth/App tokens; it requires a classic PAT with repo scope (documented in standards/github-settings.md#check-suite-auto-trigger-preferences). The repo already has GH_PAT_WORKFLOWS configured for exactly this purpose.

Plan Execution

.github/workflows/apply-repo-settings.yml — replaced administration: write with contents: read; switched GH_TOKEN from secrets.GITHUB_TOKEN to secrets.GH_PAT_WORKFLOWS; updated header comment
Dev-lead lint passed (shellcheck + agent profile checks)
Rubber-duck review — diff is 3-line change, no unintended scope creep

Test Results

  [lint] shellcheck on 1 file(s)...
  [lint] all checks passed

(Phase 2 TDD exception applied: pure CI configuration change — no observable application behaviour to unit-test.)

Files Changed

.github/workflows/apply-repo-settings.yml: removed invalid administration: write permission; added contents: read; switched API token to GH_PAT_WORKFLOWS

Notes

GH_PAT_WORKFLOWS must be a classic PAT with at least repo scope for the security_and_analysis and check-suites/preferences API calls to succeed. If the PAT lacks that scope, the job will now start and fail at the script step (a much more debuggable failure) instead of silently dropping all jobs.
The paths trigger (.github/settings.yml, scripts/apply-repo-settings.sh) is unchanged — correct, since neither file was modified by this fix.

Already working on this: an open PR exists for issue #199.

feat: implement issue #199 — [Fleet Monitor] petry-projects/TalkTerm …

feat: implement issue #454 — Compliance: ruleset-drift-pr-quality-req…

feat: implement issue #199 — [Fleet Monitor] petry-projects/TalkTerm …

Navigation Menu

Repository navigation

[Fleet Monitor] petry-projects/TalkTerm — apply-repo-settings.yml #199

🔴 CRITICAL: `petry-projects/TalkTerm` / `apply-repo-settings.yml`

Dev-Lead Implementation Plan

Root Cause

Scope

Implementation Checklist

Tests to Write

Test Command

Dev-Lead: Implementation Complete

Root Cause

Plan Execution

Test Results

Files Changed

Notes

13 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[Fleet Monitor] petry-projects/TalkTerm — apply-repo-settings.yml #199

Description

🔴 CRITICAL: petry-projects/TalkTerm / apply-repo-settings.yml

Activity

don-petry commented on Jun 8, 2026

Dev-Lead Implementation Plan

Root Cause

Scope

Implementation Checklist

Tests to Write

Test Command

don-petry commented on Jun 8, 2026

Dev-Lead: Implementation Complete

Root Cause

Plan Execution

Test Results

Files Changed

Notes

don-petry commented on Jun 9, 2026

13 remaining items

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

🔴 CRITICAL: `petry-projects/TalkTerm` / `apply-repo-settings.yml`