fix(ci): scoped permissions for preview-smoke + visual-diff workflows #16

Merged

varutasu merged 1 commit from fix/ci-permissions-vercel-preview into main

2026-05-24 15:22:13 -04:00

varutasu commented

2026-05-24 15:03:49 -04:00

(Migrated from github.com)

Summary

Both Playwright-on-Vercel workflows (preview-smoke.yml, visual-diff.yml) have been failing on every PR with 403 "Resource not accessible by integration" at the very first action (patrickedqvist/wait-for-vercel-preview@v1.3.2). This blocks two visible CI checks (Playwright smoke, Screenshot diff) and prevents any visual-regression signal from posting back to PRs.

Root cause: neither workflow declares a permissions: block, so the workflow GITHUB_TOKEN falls back to this repo's default (read-only). The Vercel wait-action and the PR-comment script both need scopes the default doesn't grant.

Fix

Minimal, least-privilege scoped permissions: blocks per workflow:

Workflow	Scope added	Why
`preview-smoke.yml`	`contents: read`	checkout (also the default, declared for clarity)
`preview-smoke.yml`	`deployments: read`	`wait-for-vercel-preview` queries the GitHub Deployments API for Vercel's per-PR deployment status
`preview-smoke.yml`	`pull-requests: read`	the action correlates the deployment back to this PR
`preview-smoke.yml`	`statuses: read`	some Vercel deployments are surfaced via commit statuses instead of Deployments
`visual-diff.yml`	all of the above	same wait-action, same reasons
`visual-diff.yml`	`pull-requests: write` ⬆️	the final `github-script` step posts a "Visual Diff" comment to the PR; previously 403'd on `POST /repos/.../issues/15/comments`

Evidence the diagnosis is right

Failure logs from PR #15 (the run that prompted this fix):

Playwright smoke / Wait for Vercel Preview deployment:
  ##[error]Resource not accessible by integration

Screenshot diff / Comment on PR with diff link:
  RequestError [HttpError]: Resource not accessible by integration
  status: 403
  url: 'https://api.github.com/repos/varutasu/tcg-vault/issues/15/comments'
  response.headers['x-accepted-github-permissions']: 'issues=write; pull_requests=write'

The x-accepted-github-permissions response header is GitHub explicitly telling us which scopes it would have accepted — pull-requests: write is the idiomatic choice (issues: write also works but is broader than needed for PR comments).

What this does NOT change

No app code, no test code, no package.json, no convoy docs.
Two YAML files only, +22 / −0.
Does not enable Playwright execution for the first time — Playwright was already running on every PR; it was just failing at the wait-step before its tests ran. After this PR merges, the smoke job will run end-to-end on every push and may surface real failures (or pre-existing baseline gaps) for the first time.

Test plan

yamllint-equivalent: workflow YAML parses (verified via local actionlint substitute — no linter errors on either file)
After merge: re-run CI on PR #15 (rebase onto new main). Both Playwright smoke and Screenshot diff should reach their actual test step instead of dying at the wait-action.
On a follow-up PR that touches pages/**: confirm visual-diff.yml posts a "Visual Diff" comment back to the PR.

Follow-ups (out of scope, queued)

If Playwright smoke now surfaces real test failures or missing baselines (likely — it's never actually run end-to-end on a green token before), that's a separate convoy. This PR is permissions-only.
If we move to a stricter security posture later, revisit whether wait-for-vercel-preview should be replaced with a Vercel-API-direct poll that avoids the GitHub Deployments dance entirely.

Made with Cursor

## Summary Both Playwright-on-Vercel workflows (`preview-smoke.yml`, `visual-diff.yml`) have been failing on every PR with **403 "Resource not accessible by integration"** at the very first action (`patrickedqvist/wait-for-vercel-preview@v1.3.2`). This blocks two visible CI checks (`Playwright smoke`, `Screenshot diff`) and prevents any visual-regression signal from posting back to PRs. Root cause: neither workflow declares a `permissions:` block, so the workflow `GITHUB_TOKEN` falls back to this repo's default (read-only). The Vercel wait-action and the PR-comment script both need scopes the default doesn't grant. ## Fix Minimal, least-privilege scoped `permissions:` blocks per workflow: | Workflow | Scope added | Why | |---|---|---| | `preview-smoke.yml` | `contents: read` | checkout (also the default, declared for clarity) | | `preview-smoke.yml` | `deployments: read` | `wait-for-vercel-preview` queries the GitHub Deployments API for Vercel's per-PR deployment status | | `preview-smoke.yml` | `pull-requests: read` | the action correlates the deployment back to this PR | | `preview-smoke.yml` | `statuses: read` | some Vercel deployments are surfaced via commit statuses instead of Deployments | | `visual-diff.yml` | all of the above | same wait-action, same reasons | | `visual-diff.yml` | `pull-requests: write` ⬆️ | the final `github-script` step posts a "Visual Diff" comment to the PR; previously 403'd on `POST /repos/.../issues/15/comments` | ## Evidence the diagnosis is right Failure logs from PR #15 (the run that prompted this fix): ``` Playwright smoke / Wait for Vercel Preview deployment: ##[error]Resource not accessible by integration Screenshot diff / Comment on PR with diff link: RequestError [HttpError]: Resource not accessible by integration status: 403 url: 'https://api.github.com/repos/varutasu/tcg-vault/issues/15/comments' response.headers['x-accepted-github-permissions']: 'issues=write; pull_requests=write' ``` The `x-accepted-github-permissions` response header is GitHub explicitly telling us which scopes it would have accepted — `pull-requests: write` is the idiomatic choice (`issues: write` also works but is broader than needed for PR comments). ## What this does NOT change - No app code, no test code, no `package.json`, no convoy docs. - Two YAML files only, +22 / −0. - Does not enable Playwright execution for the first time — Playwright was already running on every PR; it was just failing at the wait-step before its tests ran. After this PR merges, the smoke job will run end-to-end on every push and may surface real failures (or pre-existing baseline gaps) for the first time. ## Test plan - [x] `yamllint`-equivalent: workflow YAML parses (verified via local `actionlint` substitute — no linter errors on either file) - [ ] After merge: re-run CI on PR #15 (rebase onto new main). Both `Playwright smoke` and `Screenshot diff` should reach their actual test step instead of dying at the wait-action. - [ ] On a follow-up PR that touches `pages/**`: confirm `visual-diff.yml` posts a "Visual Diff" comment back to the PR. ## Follow-ups (out of scope, queued) - If `Playwright smoke` now surfaces real test failures or missing baselines (likely — it's never actually run end-to-end on a green token before), that's a separate convoy. This PR is permissions-only. - If we move to a stricter security posture later, revisit whether `wait-for-vercel-preview` should be replaced with a Vercel-API-direct poll that avoids the GitHub Deployments dance entirely. Made with [Cursor](https://cursor.com)

vercel[bot] commented

2026-05-24 15:03:54 -04:00

(Migrated from github.com)

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
tcg-vault	Ready	Preview, Comment	May 24, 2026 7:03pm

[vc]: #4yuZf6US9NdW8HFrwbDK2Wge+NKOpY6iZsW3tzNylyk=:eyJpc01vbm9yZXBvIjp0cnVlLCJ0eXBlIjoiZ2l0aHViIiwicHJvamVjdHMiOlt7Im5hbWUiOiJ0Y2ctdmF1bHQiLCJwcm9qZWN0SWQiOiJwcmpfRjZXOEVvRkd3Y0g3aWVGcnRvRlNlOXdVVkFhNSIsImxpdmVGZWVkYmFjayI6eyJyZXNvbHZlZCI6MCwidW5yZXNvbHZlZCI6MCwidG90YWwiOjAsImxpbmsiOiJ0Y2ctdmF1bHQtZ2l0LWZpeC1jaS1wZXJtaXNzLWU1NDgxMy1yYW5kYWxsLXN0aWxsd2VsbHMtcHJvamVjdHMudmVyY2VsLmFwcCJ9LCJpbnNwZWN0b3JVcmwiOiJodHRwczovL3ZlcmNlbC5jb20vcmFuZGFsbC1zdGlsbHdlbGxzLXByb2plY3RzL3RjZy12YXVsdC8zNkJrRkJ4UDJza2JjUFEyVHE5eUZWQVdiOHd3IiwicHJldmlld1VybCI6InRjZy12YXVsdC1naXQtZml4LWNpLXBlcm1pc3MtZTU0ODEzLXJhbmRhbGwtc3RpbGx3ZWxscy1wcm9qZWN0cy52ZXJjZWwuYXBwIiwibmV4dENvbW1pdFN0YXR1cyI6IkRFUExPWUVEIn1dLCJyZXF1ZXN0UmV2aWV3VXJsIjoiaHR0cHM6Ly92ZXJjZWwuY29tL3ZlcmNlbC1hZ2VudC9yZXF1ZXN0LXJldmlldz9vd25lcj12YXJ1dGFzdSZyZXBvPXRjZy12YXVsdCZwcj0xNiJ9 The latest updates on your projects. Learn more about [Vercel for GitHub](https://vercel.link/github-learn-more). | Project | Deployment | Actions | Updated (UTC) | | :--- | :----- | :------ | :------ | | [tcg-vault](https://vercel.com/randall-stillwells-projects/tcg-vault) | ![Ready](https://vercel.com/static/status/ready.svg) [Ready](https://vercel.com/randall-stillwells-projects/tcg-vault/36BkFBxP2skbcPQ2Tq9yFVAWb8ww) | [Preview](https://tcg-vault-git-fix-ci-permiss-e54813-randall-stillwells-projects.vercel.app), [Comment](https://vercel.live/open-feedback/tcg-vault-git-fix-ci-permiss-e54813-randall-stillwells-projects.vercel.app?via=pr-comment-feedback-link) | May 24, 2026 7:03pm | <a href="https://vercel.com/vercel-agent/request-review?owner=varutasu&repo=tcg-vault&pr=16" rel="noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://agents-vade-review.vercel.sh/request-review-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://agents-vade-review.vercel.sh/request-review-light.svg"><img src="https://agents-vade-review.vercel.sh/request-review-light.svg" alt="Request Review"></picture></a>

github-actions[bot] commented

2026-05-24 15:04:01 -04:00

(Migrated from github.com)

Pipeline Health

Build + CI gates

Gate	Status
Vercel build (Preview)	✅ pass
CI: Lint	✅ pass
CI: Schema map fresh	❌ skipped
Preview smoke	❌ failure
Visual diff	⏭ skipped or pending

Build runs on Vercel; this CI runs lint and schema-map drift only (no duplicate build).

Role reports

Role	Status
Reviewer report	⏳ pending
A11y audit	⏳ pending
Design system audit	⏳ pending

See individual comments above for details. This rollup updates automatically.

## Pipeline Health ### Build + CI gates | Gate | Status | | --- | --- | | Vercel build (Preview) | ✅ pass | | CI: Lint | ✅ pass | | CI: Schema map fresh | ❌ skipped | | Preview smoke | ❌ failure | | Visual diff | ⏭ skipped or pending | _Build runs on Vercel; this CI runs lint and schema-map drift only (no duplicate build)._ ### Role reports | Role | Status | | --- | --- | | Reviewer report | ⏳ pending | | A11y audit | ⏳ pending | | Design system audit | ⏳ pending | See individual comments above for details. This rollup updates automatically.