From 82820f31e40965c3e9b6afbfd6af741e2ca5407f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Martin=20Va=C5=A1ko?= Date: Fri, 19 Jun 2026 12:45:01 +0200 Subject: [PATCH] ci(release): give changelog-check step a GH token `gh release list` returns exit 4 (not authenticated) because the gate job's changelog-check step shells out to `gh` without a token in its environment. The per-job permission scoping in 16765c5 left this gh-dependent step without one. contents:read already covers listing releases, so just expose the token. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/release-kbagent.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/release-kbagent.yml b/.github/workflows/release-kbagent.yml index 6c5abd66..fdf617ae 100644 --- a/.github/workflows/release-kbagent.yml +++ b/.github/workflows/release-kbagent.yml @@ -110,6 +110,8 @@ jobs: git diff --exit-code plugins/kbagent/skills/kbagent/SKILL.md plugins/kbagent/.claude-plugin/plugin.json .claude-plugin/marketplace.json uv.lock - name: changelog-check (skipped on pre-releases) if: needs.version.outputs.IS_PRERELEASE == 'false' + env: + GH_TOKEN: ${{ github.token }} # gh release list needs auth; contents:read is enough scope run: uv run python scripts/generate_changelog.py --check # ── Build the prebuilt wheel and publish to PyPI (for the `uv`/`pipx` audience).