From a99712c14e7073897fb731159ffd9ea44d956fc4 Mon Sep 17 00:00:00 2001 From: jnasbyupgrade Date: Wed, 29 Jul 2026 13:45:58 -0500 Subject: [PATCH] ci: grant actions:write so bun cache save succeeds Both claude.yml and claude-code-review.yml run claude-code-action, which internally uses oven-sh/setup-bun with caching enabled. Cache writes require the GITHUB_TOKEN to have actions:write; with only actions:read (or none), the cache save step logs a harmless but noisy "Cache reservation failed: cache write denied: token has no writable scopes" warning on every run. --- .github/workflows/claude-code-review.yml | 5 +++++ .github/workflows/claude.yml | 7 ++++++- 2 files changed, 11 insertions(+), 1 deletion(-) diff --git a/.github/workflows/claude-code-review.yml b/.github/workflows/claude-code-review.yml index b6bed92..afa5099 100644 --- a/.github/workflows/claude-code-review.yml +++ b/.github/workflows/claude-code-review.yml @@ -38,6 +38,11 @@ jobs: contents: read pull-requests: write # post the review comments checks: read # read sibling check-runs for the cost gate + # write (not just read) needed so claude-code-action's internal + # bun-setup step can save its cache; read-only causes a harmless but + # noisy "Cache reservation failed: cache write denied: token has no + # writable scopes" warning. + actions: write steps: # COST GATE: the paid Claude review is the last thing to run. Wait for the # PR head's OTHER check-runs to finish and only proceed if they are clean. diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml index c85ec00..f5b9ce9 100644 --- a/.github/workflows/claude.yml +++ b/.github/workflows/claude.yml @@ -26,7 +26,12 @@ jobs: pull-requests: read issues: read id-token: write - actions: read # Required for Claude to read CI results on PRs + # Required for Claude to read CI results on PRs. write (not just read) + # is also needed so claude-code-action's internal bun-setup step can + # save its cache; read-only causes a harmless but noisy + # "Cache reservation failed: cache write denied: token has no writable + # scopes" warning. + actions: write steps: - name: Checkout repository # Intentionally tracks the major-version tag (not a pinned SHA) so