From 0a42d665380c93f3540cc10323a677df53d19c63 Mon Sep 17 00:00:00 2001 From: Elior Erez Date: Tue, 25 Aug 2026 14:17:11 -0400 Subject: [PATCH] Add osac-ci-bot to fulfillment-wg osac-ci-bot runs the merge-queue automation in osac-project/osac (auto-queue.yml: label removal, review dismissal, collaborator checks, auto-merge enable/disable; konflux-auto-label.yml: labeling Konflux dependency-bump PRs), but wasn't a member of any team, so it had no path to elevated repo access and fell back to the org default (read). A fine-grained PAT owned by this account can never exceed its actual collaborator role, regardless of what permissions the token itself requests -- confirmed live: every mutating call (label add, review dismiss, collaborator check, auto-merge enable/disable) 403'd until this grant exists, even with the token's own permissions correctly configured. fulfillment-wg already grants push on osac, osac-test-infra, and github-config (among others), matching what MERGE_QUEUE_TOKEN effectively has today -- same team osac-dev-bot (another bot account) is already a plain member of. Signed-off-by: Elior Erez --- team-members/fulfillment-wg.csv | 1 + 1 file changed, 1 insertion(+) diff --git a/team-members/fulfillment-wg.csv b/team-members/fulfillment-wg.csv index 2c1d981..678f28d 100644 --- a/team-members/fulfillment-wg.csv +++ b/team-members/fulfillment-wg.csv @@ -78,3 +78,4 @@ srasanen,member mvaskima,member sank-ak,member mor-rh,member +osac-ci-bot,member