Repository navigation
Fix dogfood.yml: remove invalid permissions key breaking every push since May - #656
Merged
Merged
Conversation
GitHub Actions has no `workflows` permissions scope; validation began
hard-rejecting it around 2026-05-01 ("Invalid workflow file ... Line 26:
Unexpected value 'workflows'"). Since then every push to any branch has
spawned a phantom failed dogfood run (100+ red Xs since May), and real
/dogfood comment triggers fail the same validation. Workflow-file write
access comes from the GitHub App's Workflows permission, not a job
permissions key, so nothing is lost by removing it.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
test_dogfood_has_workflows_write_permission (from issue #463) asserted the presence of the exact key that now invalidates the workflow file. The key never did anything — GITHUB_TOKEN cannot modify workflow files regardless of job permissions; that capability comes from the GitHub App's Workflows permission. Replaced with the inverse guard across all workflow files. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Found while investigating red-X noise in the Actions log during the 1.0 gate work. Every push since ~May 1 has generated a phantom failed "Remote Dev Bot (dogfood)" run, and the run page carries the actual error:
workflows: writeis not a valid GitHub Actions permissions scope and never was — GitHub evidently converted the unknown-key tolerance into a hard validation error around 2026-05-01 (the file itself hadn't changed since April 29; failures start exactly May 1). Effects: a failed run attached to every push on every branch since May (~100+ of them), and — worse — real/dogfoodcomment triggers currently fail the same validation, so the dogfood path has been silently dead for three months. Nobody noticed because rdb self-dev moved to local sessions in May (the comprehensive review's "dogfood gap" finding, independently corroborated).The fix removes the line. Workflow-file write access for dogfood runs comes from the GitHub App's Workflows permission (documented in CONTRIBUTING.md), not from a job-level permissions key, so nothing functional is lost.
After merge, the next push to dev should produce no dogfood run at all — that's the validation.
Test plan
🤖 Generated with Claude Code