molecule-ai/molecule-core
41
0
Fork 2
Code Issues 45 Pull Requests 11 Actions 65 Packages Projects Releases Wiki Activity

fix(ci): add pull-requests:write to gate-check-v3 permissions
Some checks failed
Block internal-flavored paths / Block forbidden paths (pull_request) Successful in 3s
Details
Lint curl status-code capture / Scan workflows for curl status-capture pollution (pull_request) Successful in 8s
Details
CI / Detect changes (pull_request) Successful in 13s
Details
qa-review / approved (pull_request) Failing after 11s
Details
Secret scan / Scan diff for credential-shaped strings (pull_request) Successful in 11s
Details
E2E API Smoke Test / detect-changes (pull_request) Successful in 17s
Details
Handlers Postgres Integration / detect-changes (pull_request) Successful in 17s
Details
E2E Staging Canvas (Playwright) / detect-changes (pull_request) Successful in 18s
Details
gate-check-v3 / gate-check (pull_request) Successful in 17s
Details
security-review / approved (pull_request) Failing after 12s
Details
sop-checklist / all-items-acked (pull_request) acked: 0/7 — missing: comprehensive-testing, local-postgres-e2e, staging-smoke, +4 — body-unfilled: 7
Details
CI / Platform (Go) (pull_request) Successful in 7s
Details
CI / Canvas (Next.js) (pull_request) Successful in 6s
Details
Runtime PR-Built Compatibility / detect-changes (pull_request) Successful in 22s
Details
CI / Shellcheck (E2E scripts) (pull_request) Successful in 5s
Details
sop-checklist-gate / gate (pull_request) Successful in 11s
Details
CI / Canvas Deploy Reminder (pull_request) Has been skipped
Details
CI / Python Lint & Test (pull_request) Successful in 7s
Details
sop-tier-check / tier-check (pull_request) Successful in 10s
Details
Handlers Postgres Integration / Handlers Postgres Integration (pull_request) Successful in 5s
Details
E2E Staging Canvas (Playwright) / Canvas tabs E2E (pull_request) Successful in 6s
Details
E2E API Smoke Test / E2E API Smoke Test (pull_request) Successful in 7s
Details
CI / all-required (pull_request) Successful in 2s
Details
Runtime PR-Built Compatibility / PR-built wheel + import smoke (pull_request) Successful in 2s
Details
lint-continue-on-error-tracking / lint-continue-on-error-tracking (pull_request) Failing after 1m2s
Details
lint-required-no-paths / lint-required-no-paths (pull_request) Successful in 1m6s
Details
Lint pre-flip continue-on-error / Verify continue-on-error flips have run-log proof (pull_request) Successful in 1m15s
Details
Lint workflow YAML (Gitea-1.22.6-hostile shapes) / Lint workflow YAML for Gitea-1.22.6-hostile shapes (pull_request) Successful in 1m23s
Details

Browse Source 
gate-check-v3's --post-comment was 403ing on every run because
the workflow had no explicit permissions block. Gitea Actions
defaults to contents:read only — insufficient for POST/PATCH on
/repos/{owner}/{repo}/issues/{pr}/comments.

Add workflow-level permissions:
  contents: read   — checkout base ref
  pull-requests: write — post/update gate-check comments

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
This commit is contained in:
Molecule AI · core-devops 2026-05-12 13:51:01 +00:00
parent 6625c3be12
commit d180bd3188
1 changed files with 8 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
.gitea/workflows/gate-check-v3.yml
View File

@ -32,6 +32,14 @@ on:
# iterating all open PRs when PR_NUMBER is empty.
workflow_dispatch:
permissions:
# read: contents — for checkout (base ref, not PR head for security)
# read: pull-requests — for reading PR info via API
# write: pull-requests — for posting/updating gate-check comments
# Without this the token cannot POST/PATCH /issues/comments → 403.
contents: read
pull-requests: write
env:
GITHUB_SERVER_URL: https://git.moleculesai.app