Conversation
GITHUB_TOKEN lacks the `workflow` scope, so a sync merge that picks up
upstream edits to any .github/workflows/* file is rejected at push time
("refusing to allow a GitHub App to create or update workflow ... without
`workflows` permission"). The previous auto-resolution rules only covered
pr.yml and release.yml as conflict cases; an upstream-only edit to a file
the fork hadn't customized (e.g. autofix.yml) merged cleanly and then
broke the push.
Generalize the workflow handling: in the conflict path, keep fork's
version (or keep deletion) for any .github/workflows/* file. After the
merge commits, reset .github/workflows/ back to origin/main's state and
amend the merge, so the push never contains workflow file changes.
Upstream workflow changes must now be brought in via a separate PR using
a PAT with `workflow` scope.
If upstream modifies a workflow file the push will fail (GITHUB_TOKEN lacks the `workflow` scope) and the sync will be finished locally by hand. Keep the generalized .github/workflows/* conflict resolution so auto-resolvable conflicts still complete.
4 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes the sync workflow push failure:
GITHUB_TOKENcannot push changes to.github/workflows/*— it lacks theworkflowscope, and that scope is not exposed via the workflowpermissions:block. The previous auto-resolution rules only handledpr.ymlandrelease.ymlas conflict cases. An upstream-only edit to a workflow file the fork hadn't customized (e.g.autofix.yml) merged cleanly, then broke the push.Changes
.github/workflows/*conflict keeps the fork's version (or keeps the file deleted, for modify/delete conflicts). Replaces the hard-codedpr.ymlandrelease.ymlcases..github/workflows/againstorigin/mainand restore any changed files (or delete any newly-added ones), thengit commit --amend. The pushed merge therefore never contains workflow file changes.Upstream workflow changes are no longer adopted automatically. They can be brought in via a separate PR using a PAT with
workflowscope.Test plan
Sync Upstreamworkflow on a state where upstream has modifiedautofix.ymlbut the fork has not. Confirm the merge commit lands onsync/...branch without touching.github/workflows/autofix.yml.release.ymlmodify-vs-fork-delete conflict still resolves to "deleted".pr.ymledit conflict still keeps fork version.Generated by Claude Code