Backport PRs opened by the bot sat waiting for a maintainer to click
"Approve and run workflows" before any check would start. Nine were
parked that way on 2026-08-18, and nothing surfaces them, so the
backports that carry fixes to the release lines were the ones sitting
still.
The cause is not this workflow but the repository's policy:
GET /repos/cozystack/cozystack/actions/permissions/fork-pr-contributor-approval
{"approval_policy":"all_external_contributors"}
github-actions[bot] is external under that policy, so every run
triggered by a PR it authors lands in action_required, even though the
branch is same-repo (isCrossRepository: false). An org-installed App is
not an external contributor. #3550, opened by cozystack-ci[bot] through
this same App token, drew its full check set unapproved, including a
54-minute E2E job.
So mint the App token and hand it to backport-action, matching the
pattern already used by retention, cut-prerelease, promote-rc, tags,
pull-requests and pull-requests-release. Same action pin and the same
owner: cozystack as the other ten call sites.
Scope worth being precise about: backport-action documents github_token
as "used to create and label pull requests and to comment", so this
moves PR authorship and nothing else. The git push still runs on the
credentials actions/checkout persists, so a backport carrying a
.github/workflows/ change is still rejected, and that stays true until
the App is granted workflows: write -- a permission that would let
anything able to trigger the App rewrite CI and reach every secret, and
one this change deliberately does not ask for.
The token step is gated on the same already_merged guard as the two
steps around it, so a backport the guard has already decided against
mints no credential. That makes three gated steps where the contract
test counted exactly two; it now counts three, and the count still
fails if any single gate is dropped.
Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Myasnikov Daniil
c6ea951b7d