From df3d0d2cb077360f58040933c34cc2c22cc2cb0c Mon Sep 17 00:00:00 2001 From: Francisco Solla Date: Wed, 19 Aug 2026 23:29:06 -0300 Subject: [PATCH] =?UTF-8?q?fix(ci):=20volta=20contents:=20write=20no=20saf?= =?UTF-8?q?ety=20net=20de=20auto-merge=20=E2=80=94=20enablePullRequestAuto?= =?UTF-8?q?Merge=20exige=20(verificado=20ao=20vivo=20PR=20#2)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .github/workflows/agent-pr-ready-automerge.yml | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/.github/workflows/agent-pr-ready-automerge.yml b/.github/workflows/agent-pr-ready-automerge.yml index 94199d0..1108227 100644 --- a/.github/workflows/agent-pr-ready-automerge.yml +++ b/.github/workflows/agent-pr-ready-automerge.yml @@ -11,9 +11,12 @@ # mergeia quando todo required check (o check-run `checks` do ci.yml) está # verde e o PR é mergeável. Nada a pollar, nada a confiar localmente. # -# Permissions mínimas: a mutation de auto-merge exige só `pull-requests: -# write` — `contents: read` (default) basta para o checkout; nada de token de -# push para o código do branch de uma PR (mesmo em repo com colaboradores). +# Permissions: a mutation GraphQL `enablePullRequestAutoMerge` exige +# `contents: write` + `pull-requests: write` com o GITHUB_TOKEN built-in — +# VERIFICADO AO VIVO (PR #2, 2026-08-20): reduzir para `contents: read` + +# `pull-requests: write` faz o job falhar com "GitHub GraphQL: Resource not +# accessible by integration". Não "otimizar" de volta para read — quebra o +# safety net. name: PR Ready + auto-merge @@ -23,7 +26,7 @@ on: branches: [main] permissions: - contents: read + contents: write pull-requests: write jobs: