[jaywedgeworth22]

Summary

• Granted the auto-merge workflow’s token read access to Checks, Actions, and Issues while preserving its existing write access to repository contents and pull requests.
• These scopes support the reusable workflow’s in-flight auto-merge gate, whose token cannot exceed the caller’s permissions and may fail to start when required read scopes are omitted.
• The reusable workflow is currently pinned to a SHA that predates the gate, so the new permissions do not affect that pinned revision.
• Test coverage was added in test/branch-protection-gate.test.ts, whose auto-merge caller guard now asserts that the workflow-level permissions: block keeps contents: write, pull-requests: write, checks: read, actions: read and issues: read (commit 0d98fc5).

---

Summary

• Ensure the auto-merge caller retains the read scopes required by the reusable branch-protection gate: checks: read, actions: read, and issues: read, alongside contents: write and pull-requests: write.
• Add regression coverage that prevents these workflow-level permissions from being removed. Without the read scopes, the reusable gate cannot inspect check runs or queued workflows and fails before pull requests can be armed.

Tests

• Updated test/branch-protection-gate.test.ts to assert that all five required permissions remain declared at the auto-merge workflow level.

[kody-ai]

Kody Review Complete

Great news! 🎉
No issues were found that match your current review configurations.

Keep up the excellent work! 🚀

⚠️ 2 Kody Rule(s) were not evaluated

These rules declare that they need repository context beyond this diff, and the review could not retrieve it, so they were not judged on this pull request:

• Never move or delete existing app support.html URLs
• Choose the Right Zod Strictness Mode for External Envelopes

Kody Guide: Usage and Configuration

Interacting with Kody

• Request a Review: Ask Kody to review your PR manually by adding a comment with the @kody start-review command at the root of your PR.

• Validate Business Logic: Ask Kody to validate your code against business rules by adding a comment with the @kody -v business-logic command.

• Provide Feedback: Help Kody learn and improve by reacting to its comments with a 👍 for helpful suggestions or a 👎 if improvements are needed.

Current Kody Configuration

Review Options

The following review options are enabled or disabled:

Options	Enabled
Bug	✅
Performance	✅
Security	✅
Business Logic	✅

Access your configuration settings here.

​

[kody-ai]

PR description incorrectly says no test changes were included

Revises an earlier Kody suggestion on .github/workflows/auto-merge-prs.yml:64 (2026-10-21 13:54 UTC).

The PR description leaves a false record of test coverage even though the auto-merge caller guard now asserts checks: read, actions: read, and issues: read. Update its status to describe these regression assertions.

Kody rule violation: Preserve verification records

Prompt for LLM

PR description incorrectly says no test changes were included

**Revises an earlier Kody suggestion** on `.github/workflows/auto-merge-prs.yml:64` (2026-10-21 13:54 UTC).

The earlier request to add assertions for the three read scopes is now implemented by lines 277-283, but the PR description still says no test changes were included and that the guard does not assert them. Update that status to describe the added assertions; otherwise the PR preserves a false verification record about its coverage.

Kody rule violation: [Preserve verification records](https://app.kodus.io/settings/code-review/global/kody-rules/115a575d-3700-4ec6-b6fa-d7518615f969?teamId=69360e3a-6b41-45d2-9e49-fde78fe49457)

​