From 8bde463d37812b51d331dba63a9ed327e14de028 Mon Sep 17 00:00:00 2001 From: forkwright Date: Thu, 3 Sep 2026 11:47:34 -0500 Subject: [PATCH] fix(release-pr-checks): grant checks: read on the heal job rollup_size() reads statusCheckRollup via GraphQL; a non-empty rollup 403s (Resource not accessible by integration) without checks: read, burning red hourly on hestia while the approval work itself succeeded. Empty rollups query fine, which is why green consumers never saw it. Callers must grant the same. --- .github/workflows/release-pr-checks.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.github/workflows/release-pr-checks.yml b/.github/workflows/release-pr-checks.yml index 7aef310..66338df 100644 --- a/.github/workflows/release-pr-checks.yml +++ b/.github/workflows/release-pr-checks.yml @@ -57,7 +57,12 @@ jobs: permissions: # actions: write approves the held runs; pull-requests: read finds the open # release PR and its head SHA. Nothing here writes to a PR. + # checks: read lets rollup_size() read statusCheckRollup via GraphQL — a + # non-empty rollup 403s without it (Resource not accessible by integration), + # which burned red hourly on hestia while the heal itself worked. Callers + # must also grant it: a caller cap downgrades whatever the callee declares. actions: write + checks: read contents: read pull-requests: read steps: