Repository navigation
fix(release): grant actions:write + drop broken auto-merge on tap - #1336
Merged
Merged
Conversation
Two bugs surfaced on the v1.3.26 release: 1. release.yml's new `Trigger Homebrew cask bump` step failed with HTTP 403 "Resource not accessible by integration". The publish-release job's permissions block only listed `contents: write`, but POST /actions/workflows/:id/dispatches requires `actions: write` on the scoped-down GITHUB_TOKEN. Added the permission. 2. Even when the bump workflow does run, its `gh pr merge --auto` was silently no-op'ing against the homebrew-orca tap, leaving bump PRs open. `--auto` only activates when there's a required check or branch-protection rule to wait on; the tap intentionally has neither. Switched to a direct squash-merge so the tap stays hands-free as originally intended. Co-authored-by: Orca <help@stably.ai>
mralexsaavedra
pushed a commit
to mralexsaavedra/orca
that referenced
this pull request
May 2, 2026
…ablyai#1336) Two bugs surfaced on the v1.3.26 release: 1. release.yml's new `Trigger Homebrew cask bump` step failed with HTTP 403 "Resource not accessible by integration". The publish-release job's permissions block only listed `contents: write`, but POST /actions/workflows/:id/dispatches requires `actions: write` on the scoped-down GITHUB_TOKEN. Added the permission. 2. Even when the bump workflow does run, its `gh pr merge --auto` was silently no-op'ing against the homebrew-orca tap, leaving bump PRs open. `--auto` only activates when there's a required check or branch-protection rule to wait on; the tap intentionally has neither. Switched to a direct squash-merge so the tap stays hands-free as originally intended. Co-authored-by: Orca <help@stably.ai>
enrick-dev
pushed a commit
to enrick-dev/orca
that referenced
this pull request
Oct 15, 2026
…ablyai#1336) Two bugs surfaced on the v1.3.26 release: 1. release.yml's new `Trigger Homebrew cask bump` step failed with HTTP 403 "Resource not accessible by integration". The publish-release job's permissions block only listed `contents: write`, but POST /actions/workflows/:id/dispatches requires `actions: write` on the scoped-down GITHUB_TOKEN. Added the permission. 2. Even when the bump workflow does run, its `gh pr merge --auto` was silently no-op'ing against the homebrew-orca tap, leaving bump PRs open. `--auto` only activates when there's a required check or branch-protection rule to wait on; the tap intentionally has neither. Switched to a direct squash-merge so the tap stays hands-free as originally intended. Co-authored-by: Orca <help@stably.ai>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Two bugs surfaced on the v1.3.26 release — both caught before users were affected thanks to manual dispatch + manual PR merge:
1.
Trigger Homebrew cask bumpstep failed with HTTP 403```
could not create workflow dispatch event: HTTP 403:
Resource not accessible by integration
```
The `publish-release` job's permissions block only listed `contents: write`, but `POST /actions/workflows/:id/dispatches` requires `actions: write` on the scoped-down `GITHUB_TOKEN`. Added the permission.
Ref: failing job on v1.3.26.
2. Tap bump PRs were left open even when the bump did run
Even when `homebrew-bump.yml` ran successfully (via manual dispatch for v1.3.25 and v1.3.26), the final `gh pr merge --auto` was silently no-op'ing. `--auto` only activates when there is a required check or branch-protection rule to wait on; the tap intentionally has neither, so the PR stayed OPEN forever.
Switched to a direct `gh pr merge --squash --delete-branch` so the tap stays hands-free as originally intended. Both prior bump PRs (stablyai/homebrew-orca#1 and #2) have been merged manually, so the tap now serves v1.3.26.
State right now
orca 1.3.26with matching sha256s (verified via GitHub API).brew update && brew install --cask stablyai/orca/orcagets users the latest.Test plan
homebrew-bump.ymldispatched manually for v1.3.26 — completed in 16s, PR opened in tap, merged.Made with Orca 🐋