Add one-time manual diagnostic to list org fine-grained permissions - #175
Merged
Conversation
github-config#173 shipped a github_organization_role permission string (manage_organization_runners) that GitHub's API rejected with 422 Invalid permission -- GitHub's docs only show the UI label for these, not the identifier string. Rather than guess again, add a read-only, manual-only workflow_dispatch step that queries the live organization-fine-grained-permissions API via the same app token Terraform already uses, so the real value can be read once from the job summary instead of guessed. NO-ISSUE
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository: osac-project/coderabbit/.coderabbit.yaml Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
WalkthroughThe workflow adds an optional manual input. When enabled, it lists organization fine-grained permissions, writes complete and runner-filtered results to the job summary, and skips Terraform changes. ChangesOrganization permission listing
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 11✅ Passed checks (11 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/apply.yaml:
- Around line 80-92: Ensure the diagnostic mode controlled by
inputs.list_org_fine_grained_permissions remains read-only by gating every
mutating Terraform step, including TF Import, TF State Remove, and TF Apply,
with the condition that this input is not true; preserve normal execution when
the diagnostic input is false.
- Around line 82-85: Update the diagnostic step running the gh api command to
clear AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY in its step-level environment,
or remove those credentials from job scope and apply them only to the OpenTofu
steps. Keep GITHUB_TOKEN available for the organization-fine-grained-permissions
request.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: osac-project/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: ec4b8925-5456-463c-9af1-deb4f18a5040
📒 Files selected for processing (1)
.github/workflows/apply.yaml
TF Apply had no guard at all, so a dispatch setting only list_org_fine_grained_permissions=true would still run a full mutating apply afterward, contradicting the step's own read-only description. Gate TF Import, TF State Remove, and TF Apply on this input being unset, and clear the unused AWS backend credentials from the diagnostic step's own env, matching the existing pattern on the 'File an issue on apply failure' step.
This was referenced Aug 7, 2026
eliorerz
added a commit
that referenced
this pull request
Aug 7, 2026
The live organization-fine-grained-permissions API rejected manage_organization_runners (422); a one-time diagnostic dispatch (github-config#175, #177) confirmed the real identifier is write_organization_runners_and_runner_groups ("Manage organization runners and runner groups"). Fix the role's permissions list, and remove the diagnostic step and its input entirely -- it was genuinely one-time (unlike exclude_addresses/state_rm_addresses/import_address, which are reusable escape hatches), so apply.yaml is restored to its pre-#175 shape. NO-ISSUE
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
PR #173 shipped
github_organization_role.runner_managerwithpermissions = ["manage_organization_runners"]. The apply that merge triggered failed:(Full failure, auto-filed per the existing failure-isolation mechanism: #174.) This confirms the app does have write access to custom org roles -- it's purely a wrong permission-string problem, not an installation-permission blocker. GitHub's docs only ever show the UI label ("Manage organization runners and runner groups"), never the identifier string, so guessing again isn't worth it when the live API can just answer directly.
Adds a manual-only, read-only
workflow_dispatchstep (list_org_fine_grained_permissions) that callsGET /orgs/{org}/organization-fine-grained-permissionsusing the same app token Terraform already uses, and writes the full permission list (plus a runner-filtered subset) to the job summary. No Terraform involved, no state touched. A no-op for the normal scheduled/push triggers.Plan once merged
list_org_fine_grained_permissions=trueandexclude_addresses=github_organization_role.runner_manager,github_organization_role_team.runner_manager_wg_infra(the existing escape hatch from NO-ISSUE: Add failure isolation to Apply configuration workflow #169) in the same run, so the other 4 pending unrelated changes blocked since the Grant wg-infra org-level self-hosted runner management #173 apply failure aren't held up further while this gets sorted.organization.tfwith the correct string in a fast-follow PR, and remove this diagnostic step in the same PR (one-time use, no ongoing utility once the string is known -- unlikeexclude_addresses/state_rm_addresses/import_address, which are reusable escape hatches).NO-ISSUE
Summary by CodeRabbit