Compare commits

...

2 Commits

Author SHA1 Message Date
GitHub Action
341e7cf34c [automated] Apply ESLint and Oxfmt fixes 2026-06-19 23:12:18 +00:00
christian-byrne
11b2302a75 fix: give backport push a token that can update workflow files
The backport job checked out with the default GITHUB_TOKEN and reused those
credentials for `git push`. GitHub refuses to let that token create or update
files under .github/workflows/**, so any PR that also touches a workflow file
fails the push with:

  ! [remote rejected] ... (refusing to allow a GitHub App to create or update
    workflow `.github/workflows/ci-tests-e2e.yaml` without `workflows` permission)

Because the run step inherits `set -e`, the loop aborted before writing the
`failed=` output, so the "Comment on failures" step posted nothing - the
backport just silently failed (see PR #12804: cherry-pick succeeded on every
target, only the push was rejected, and all four had to be created by hand).

Check out with PR_GH_TOKEN - already used by the Create-PR step - so the push
carries `workflow` scope. PR_GH_TOKEN must have workflow write permission for
this to take effect.
2026-06-19 16:08:14 -07:00

View File

@@ -67,6 +67,11 @@ jobs:
uses: actions/checkout@v6
with:
fetch-depth: 0
# Persist a token with `workflow` scope so the backport push can
# include changes to .github/workflows/**. The default GITHUB_TOKEN
# is refused by GitHub when a push creates/updates workflow files,
# which silently aborted the whole job (see PR #12804 backport).
token: ${{ secrets.PR_GH_TOKEN }}
- name: Configure git
run: |