Hacktoberfest 2026：メンテナが10月に向けて印を付けた、オープンで初心者向けの issue。 Hacktoberfest の issue を見る

CI shepherd: a permanent auto-merge refusal (token lacks workflow scope) fails every pass and flaps needs-fix -> run storm

クローズ
  • 何か問題がありますか？
#6,061 コメント 0 件 リアクション 0 件 担当者 0 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

まだ誰も着手していません。

評価

難易度
4/5
見積もり時間
3〜5日
初心者へのやさしさ
56/100
issue の種類
バグ
明瞭さ
明確に書かれている
活発さ
活発
技術スタック
github, github-actions, python
領域
ci-cd, devops

調査の方向性

Start by reading the apply() and decide() paths in shepherd_gh.py, then inspect the shepherd event and reconcile workflows to understand how status labels trigger runs. Replay the #5950 merge-ready sequence in tests/tools/test_shepherd_gh.py; done means a permanent permission refusal gets one owner-facing status and comment, causes no repeated merge attempts or label churn, and does not fail the run.

索引モデルが issue の本文から書いたものです。

説明

bug ci-cd priority: high scope:infra

What happened (2026-10-22, ~16:21Z–20:03Z)

PR #5950 had shepherd:merge and edited .github/workflows/det-sweep.yml. AUTOMATION_PAT lacked the Workflows permission, so every gh pr merge --auto call failed:

#5950 auto-merge on: FAILED: GraphQL: Pull request refusing to allow a Personal Access Token to create or update workflow `.github/workflows/det-sweep.yml` without `workflow` scope (enablePullRequestAutoMerge)

shepherd_gh.py exited 1 on that failure, and the PR's shepherd:needs-fix label kept flipping on and off: each reconcile pass removed it, and it was then re-added. Every add or remove fired another shepherd-event.yml run, which failed the same way. Result: about 100 label flips on #5950, about 195 red shepherd runs (99 label-event, 95 reconcile on main) and about 950 runner-minutes, until the owner merged #5950 by hand.

Fix (shepherd only)

  1. In apply(), recognise a permanent permission refusal (the without \workflow` scope` / "refusing to allow a Personal Access Token" GraphQL error, and similar 403 or permission errors) as distinct from a transient failure.
  2. On that error, label the PR once with an owner-facing status (e.g. shepherd:needs-owner, or reuse an existing one) and post one comment that says why ("this PR edits workflow files; the shepherd token can't enable auto-merge. Merge it by hand, or give AUTOMATION_PAT Workflows: read and write"). Don't exit non-zero for it.
  3. decide() must skip auto-merge attempts on a PR carrying that status, so neither reconcile nor the label event retries it every pass.
  4. Stop the needs-fix flapping: a pass must not remove a status label that the same or the next pass will put straight back. Add a regression test in tests/tools/test_shepherd_gh.py that replays the #5950 sequence (merge-ready + auto-merge refused) and asserts there is no label churn and the run does not fail.

Optional: decide() could pre-check whether a PR touches .github/workflows/ and go straight to the owner label, without trying auto-merge first.

Owner side

The owner has updated the token (2026-10-22, ~20:05Z); not yet confirmed on a live workflow-editing PR. The fix above should land regardless, because any future permission gap would cause the same storm.

Evidence: runs 39813308373 (first reconcile failure) … 39844551634 (last label-event failure); #5950 issue events.

主要言語
Python
スター
57
フォーク
11
平均マージ
1時間 20分
マージ済み PR（30日）
985

環境構築

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

squid-protocol/gitgalaxy のほかの issue

squid-protocol/gitgalaxy の issue をすべて見る

似ている issue

Python の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。