From 9d5e3dbd1f97ba3b945473d6211e1dcbd3c432e3 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Tue, 1 Sep 2026 20:44:04 +0000 Subject: [PATCH] fix(ci): grant actions:write for npm cache saves Publish and integration workflows restrict GITHUB_TOKEN to contents:read, which can restore caches but cannot reserve/write them. That produced the setup-node warning "cache write denied: token has no writable scopes" after a successful 0.2.4 publish. Add actions:write so cache: npm can save. Co-authored-by: ProxyMesh AI --- .github/workflows/proxy_integration_tests.yml | 2 ++ .github/workflows/publish.yml | 3 +++ 2 files changed, 5 insertions(+) diff --git a/.github/workflows/proxy_integration_tests.yml b/.github/workflows/proxy_integration_tests.yml index 25a7685..bb01325 100644 --- a/.github/workflows/proxy_integration_tests.yml +++ b/.github/workflows/proxy_integration_tests.yml @@ -10,6 +10,8 @@ on: permissions: contents: read + # Required for setup-node npm cache save under restricted GITHUB_TOKEN scopes. + actions: write jobs: integration: diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 2a71f70..f536550 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -18,8 +18,11 @@ jobs: github.event.workflow_run.conclusion == 'success' runs-on: ubuntu-latest # Explicit job permissions: org default token scopes must not block OIDC. + # actions: write is required for setup-node's npm cache save (contents: read alone + # can restore but not reserve/write caches → "token has no writable scopes"). permissions: contents: read + actions: write id-token: write steps: - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3