From 6e5e369f6065859eced550a85eb2430e17d0e64b Mon Sep 17 00:00:00 2001 From: Claude Bot Date: Wed, 28 Oct 2026 01:26:10 +0100 Subject: [PATCH] fix(review-bot): mint the review token with read:issue The sweep lists PRs that request review-bot via /repos/issues/search, which needs read:issue. Co-Authored-By: Claude Opus 5.5 --- kubernetes/infrastructure/openbao/rotation/review-bot.yaml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/kubernetes/infrastructure/openbao/rotation/review-bot.yaml b/kubernetes/infrastructure/openbao/rotation/review-bot.yaml index 2b57aef6..69ebcf59 100644 --- a/kubernetes/infrastructure/openbao/rotation/review-bot.yaml +++ b/kubernetes/infrastructure/openbao/rotation/review-bot.yaml @@ -111,8 +111,9 @@ spec: # push, or repoint this at another private repo it collaborates on. - name: GITEA_VERIFY_REPO value: konairius/shelly-manager + # read:issue: the sweep lists requested reviews via /repos/issues/search. - name: GITEA_SCOPES - value: write:repository + value: write:repository,read:issue # review-bot posts reviews via the API (write:repository scope) # but never git-pushes, and is only a read collaborator, so push # verification would fail. The private-repo pull check above is -- 2.54.0