From 5988f45a861d7b4dacb836830dd9e92c2feef9ae Mon Sep 17 00:00:00 2001 From: ai-nlma Date: Mon, 6 Jul 2026 02:47:35 +0000 Subject: [PATCH] Add workflow OAuth scope so MCP can manage .github/workflows/*.yml GitHub returns 404 on writes to .github/workflows/* without the workflow scope, even when repo is granted. Bump the default GITHUB_SCOPES fallback and docs; existing users still need to disconnect/reconnect to mint a token with the new scope. Fixes #1 --- .env.example | 3 ++- CLAUDE.md | 2 +- README.md | 2 +- src/github-oauth.ts | 2 +- 4 files changed, 5 insertions(+), 4 deletions(-) diff --git a/.env.example b/.env.example index 814b2e6..b4c9258 100644 --- a/.env.example +++ b/.env.example @@ -16,7 +16,8 @@ GITHUB_CLIENT_ID=Iv1.xxxxxxxxxxxxxxxx GITHUB_CLIENT_SECRET=CHANGE_ME # Comma-separated GitHub OAuth scopes. Conservative default; bump as needed. -GITHUB_SCOPES=repo,read:org,read:user,read:project +# `workflow` is required for creating/updating files under .github/workflows/*. +GITHUB_SCOPES=repo,read:org,read:user,read:project,workflow # --- Optional ---------------------------------------------------------------- diff --git a/CLAUDE.md b/CLAUDE.md index 3a4a382..1089a79 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -55,4 +55,4 @@ All required env vars are validated at startup in [src/index.ts](src/index.ts): - `API_KEY_HASH_SALT` — ≥32 chars random; drives both the token-encryption HKDF key and the tenant-id-hash salt. **Rotating this orphans every stored GitHub token**. - `GITHUB_CLIENT_ID` / `GITHUB_CLIENT_SECRET` — from the GitHub OAuth App. - `BASE_URL` — `https://github.nlma.io` in prod. Used for OAuth metadata issuer and the GitHub callback URL. -- `GITHUB_SCOPES` (default `repo,read:org,read:user,read:project`), `UPSTREAM_MCP_URL` (default `http://127.0.0.1:3060`), `GITHUB_ALLOWED_USERS` (optional CSV allowlist). +- `GITHUB_SCOPES` (default `repo,read:org,read:user,read:project,workflow`), `UPSTREAM_MCP_URL` (default `http://127.0.0.1:3060`), `GITHUB_ALLOWED_USERS` (optional CSV allowlist). diff --git a/README.md b/README.md index dc383b8..5f7b668 100644 --- a/README.md +++ b/README.md @@ -40,7 +40,7 @@ Copy `.env.example` to `.env` and fill in. Required: | `GITHUB_CLIENT_ID` | From the GitHub OAuth App you register (see below). | | `GITHUB_CLIENT_SECRET` | Same. Treat as secret. `.env` should be `chmod 600`. | | `BASE_URL` | `https://github.nlma.io` | -| `GITHUB_SCOPES` | Default `repo,read:org,read:user,read:project`. Bump if a tool needs more. | +| `GITHUB_SCOPES` | Default `repo,read:org,read:user,read:project,workflow`. `workflow` is required to create/update `.github/workflows/*` files. Bump if a tool needs more. | | `UPSTREAM_MCP_URL` | Default `http://127.0.0.1:3060` — the github-mcp-server docker container. | | `GITHUB_ALLOWED_USERS` | Optional CSV allowlist of GitHub logins. Empty = anyone with a GitHub account. | diff --git a/src/github-oauth.ts b/src/github-oauth.ts index 824169d..0d1bd60 100644 --- a/src/github-oauth.ts +++ b/src/github-oauth.ts @@ -14,7 +14,7 @@ function getEnv(name: string): string { } export function getGithubScopes(): string[] { - const raw = process.env.GITHUB_SCOPES ?? "repo,read:org,read:user,read:project"; + const raw = process.env.GITHUB_SCOPES ?? "repo,read:org,read:user,read:project,workflow"; return raw .split(",") .map((s) => s.trim())