mirror of
https://github.com/ComposioHQ/composio.git
synced 2026-09-22 11:46:35 +08:00
Alberto Schiabel
bcb839b745
## Problem
`docs.changelog-to-docs.yml` fails at `gh pr create` on every run that
has documentation changes:
```
pull request create failed: GraphQL: GitHub Actions is not permitted to
create or approve pull requests (createPullRequest)
```
The repository has *Allow GitHub Actions to create and approve pull
requests* disabled:
```console
$ gh api repos/ComposioHQ/composio/actions/permissions/workflow
{"default_workflow_permissions":"read","can_approve_pull_request_reviews":false}
```
That setting gates PR **creation** as well as approval, and it overrides
whatever the job's `pull-requests` permission grants. `GITHUB_TOKEN`
simply cannot open a PR in this repo.
This is not a new regression. The last PR this workflow successfully
opened was #3466 on 2026-05-20; the setting was flipped off some time
after. Since then every run with docs changes has failed at this step —
**13 failures**, leaving **36 orphaned `docs/changelog-update-*`
branches** on the remote, because the step pushes the branch and then
dies. #3816 was opened by hand to rescue one of them.
Every other PR-opening workflow in this repo already mints a release-bot
App token for exactly this reason. These two were missed. On the same
commit `661d7b5`, `docs.sdk-change-sync.yml` (app token) ran its
create-PR and request-review steps green while
`docs.changelog-to-docs.yml` failed.
## Changes
**`docs.changelog-to-docs.yml`** — the root-cause fix:
- Mint a release-bot App token, same pinned action SHA and
`vars`/`secrets` names as the sibling workflows.
- Check out with that token, so the push is authored by the app and PR
CI triggers.
- `gh pr create` runs with the app token instead of `GITHUB_TOKEN`.
- `id-token: write` added to match the siblings.
**`docs.sync-connect-clients.yml`** — the same defect, latent: its
`peter-evans/create-pull-request` step passed no `token:`, so it fell
back to `github.token` and would hit the identical block on its next
docs change.
**Reviewer request split out of `gh pr create`** (both files, matching
`docs.sdk-change-sync.yml`): an unassignable actor previously failed the
whole command *after* the branch was already pushed — which is precisely
what turned each failure into an orphaned branch. It is now a separate
`continue-on-error` step.
## Verification
Repo lint/prettier cover only `**/*.{ts,tsx,js,jsx,json,md}`, so nothing
gates workflow YAML; these were checked manually:
| Check | Result |
|---|---|
| `yaml.safe_load` both files | OK |
| `bash -n` on the extracted PR script | OK |
| PR step with a stubbed `gh` | branch name byte-identical to the real
run; multi-line body survives the nested heredoc; `pull-request-number`
emitted |
| No-changes path | `No documentation changes needed`, exit 0, no `gh`
call |
| `pnpm lint` / `pnpm typecheck` | pass |
The nested `$(gh pr create … "$(cat <<'EOF' …)")` was the one genuinely
risky part of the edit, so it was exercised rather than eyeballed.
## Follow-ups (not in this PR)
- 36 orphaned `docs/changelog-update-*` branches need pruning;
`docs/changelog-update-661d7b5` carries a real Codex docs commit worth
salvaging first.
- `git add -A` in the PR step is unscoped — the siblings constrain this
with `add-paths`. Not the cause of this failure.
- `Docs Health Check` is separately failing on `661d7b5`.