fix(ci): restore contents scope and narrow disable-automerge

[tomymaritano]

What removing || true revealed

The disable-automerge job fails with:

FORBIDDEN — Resource not accessible by integration

It had been failing silently behind || true (see run 32602609796 on #571). The safety net that is supposed to stop a queued auto-merge from landing on an unprotected base has never actually worked — it just reported green.

Honest note on cause

I cannot prove this was pre-existing. The job lost contents: write earlier in #566 when I scoped workflow-level permissions per job on a least-privilege review, and || true meant no run before or after ever surfaced a failure. Two live hypotheses:

1. The mutation needs contents: write and the least-privilege narrowing broke it.
2. It was already FORBIDDEN and the suppression hid it.

This PR tests hypothesis 1 by granting the scope back. If FORBIDDEN returns with both scopes present, the cause is a repository or org restriction on GITHUB_TOKEN and needs a settings change or a PAT — the comment in the file says so, so the next person does not have to rediscover it.

Scope narrowing

The job fired on every PR whose base was not develop, which includes release promotions into main. main is protected; there is no unsafe queued merge to undo there. The risk this job exists for is landing on an unprotected base, so it now fires only on drafts, or on a base that is neither develop nor main.

Not changed

The loud failure stays. Going back to || true would restore exactly the false confidence that hid this.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Updated automated merge handling for draft pull requests.
  • Protected pull requests targeting main and develop from automatic processing.
  • Enabled the required repository content permissions for the automation workflow.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 5c929207-12c2-40e5-ba52-467fd84ff11c

📥 Commits

Reviewing files that changed from the base of the PR and between b378a93 and 6fd52d0.

📒 Files selected for processing (1)

• .github/workflows/automerge.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The disable-automerge job now has contents: write permission. Its condition continues to include drafts and excludes pull requests targeting develop or protected main.

Changes

Automerge workflow controls

Layer / File(s)	Summary
Update disable-automerge controls .github/workflows/automerge.yml	The job adds contents: write and skips pull requests targeting main while retaining the existing develop exclusion and draft handling.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: 🔵 Low · up to 6fd52

The workflow restores the requested write access and narrows the safeguard to relevant branches, but repository or pull-request-specific token policies may still prevent it from cancelling unsafe queued merges. The PR is mergeable with explicit owner follow-up to verify affected fork and Dependabot cases and adjust authorization if needed.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes restoring the contents scope and narrowing the disable-automerge job.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/disable-automerge-permission

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[tomymaritano]

New evidence that weakens this PR's stated hypothesis. Read before merging.

The v0.17.0 release run surfaced a second permission failure, in a different job:

sync-develop → Create sync PR
pull request create failed: GraphQL: GitHub Actions is not permitted to
create or approve pull requests (createPullRequest)

And the settings confirm it, at both repo and org level:

gh api repos/dripnex/app/actions/permissions/workflow
{ "default_workflow_permissions": "read", "can_approve_pull_request_reviews": false }

gh api orgs/dripnex/actions/permissions/workflow
{ "default_workflow_permissions": "read", "can_approve_pull_request_reviews": false }

So GITHUB_TOKEN is restricted org-wide. That makes hypothesis 2 in the PR body — a repository or org restriction — considerably more likely than hypothesis 1, which is what this PR actually implements. A workflow can still elevate past default_workflow_permissions: read with an explicit permissions: block, so the pull-requests: write on that job should have applied and it still returned FORBIDDEN.

The scope narrowing in this PR (not firing on promotions into main) stands on its own and is worth keeping either way. The contents: write restoration is still a legitimate experiment, but it should be read as a test, not a fix — if FORBIDDEN returns, the answer is the org setting.

The larger finding: sync-develop is this repo's own automation for the main → develop back-merge. It has never worked for the same reason. I did that back-merge by hand three times tonight (#578, #579, #581) before getting the ancestry right. Turning on Settings → Actions → General → Allow GitHub Actions to create and approve pull requests would let the repo do it itself after every release.

That is a settings change and Tomás's call, so I have not touched it.

[github-actions]

🎉 This PR is included in version 0.18.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀