From 1911ced6a0568dbcba51905bc2cb77a15c5771bd Mon Sep 17 00:00:00 2001 From: Joel Hawksley Date: Mon, 24 Aug 2026 13:59:09 -0600 Subject: [PATCH] Skip push-permission probe in script/publish under GitHub Actions check_github_permissions runs: gh api repos/ViewComponent/view_component -q '.permissions.push // false' But GET /repos/:owner/:repo only returns the '.permissions' object for user/OAuth tokens. For the workflow's GITHUB_TOKEN the field is absent, so '.permissions.push // false' resolves to "false" and the script bails with 'insufficient permissions to create releases' even though the publish-release job declares 'contents: write'. Skip the probe when GITHUB_ACTIONS is set. In CI we already rely on the job's declared permissions; any real permission problem will surface with a clear message from the actual 'git push' or 'gh release create' calls that follow. Local runs still get the probe. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 217f0a0d-a9f2-4607-9643-5fcb3e34f20f --- script/publish | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/script/publish b/script/publish index 91bb3caa7..68d31e4fd 100755 --- a/script/publish +++ b/script/publish @@ -15,6 +15,17 @@ check_github_permissions() { exit 1 fi + # Skip the push-permission probe when running in GitHub Actions. + # GET /repos/:owner/:repo only returns `.permissions` for user/OAuth + # tokens — for the workflow's GITHUB_TOKEN the field is absent, so + # the probe would incorrectly report no push access even when the + # workflow has `contents: write`. In CI we rely on the job's declared + # permissions; failures will surface from the actual git push / gh + # release create calls below with clear messages. + if [ -n "${GITHUB_ACTIONS:-}" ]; then + return 0 + fi + # Check if user can create releases (requires write access) # Attempt a dry-run by checking repo permissions local perms=$(gh api repos/ViewComponent/view_component -q '.permissions.push // false')