Summary

One-line permission addition (statuses: write) that fixes the persistent Repository has changed during renovation aborts every Renovate run has hit since PR #4.

Root cause

The error message is misleading. Pulled the debug-level log from run 25346172853:

Request failed with status code 403 (Forbidden):
  POST https://api.github.com/repos/njhensley/aicr/statuses/cf3dc7d1...
  "message": "Resource not accessible by integration"
  "x-accepted-github-permissions": "statuses=write"

DEBUG: Caught error setting branch status - aborting
Error: integration-unauthorized
    at setStability (status-checks.ts:94:3)
    at setBranchStatusChecks (branch/index.ts:64:3)
    at processBranch (branch/index.ts:776:5)

DEBUG: Passing repository-changed error up
INFO: Repository has changed during renovation - aborting

After Renovate creates each branch, it calls POST /repos/{owner}/{repo}/statuses/{sha} to write a stability status check (used by the cooldown / merge-confidence pipeline). Our workflow's permissions: block had contents, pull-requests, and issues write, but not statuses. The 403 propagates as integration-unauthorized, which Renovate's error handler maps internally to repository-changed — a wildly misleading message for what's actually a missing OAuth scope.

NVIDIA/gpu-operator's workflow works because they don't set permissions: at all, so GitHub falls back to default write-all which implicitly includes statuses: write. We were trying to be principle-of-least-privilege but blocked a required scope.

PRs #5 and #6 (drop checkout / restore configurationFile / conditional dry-run) chased symptoms that couldn't have been the cause. Their changes are still defensible on their own merits (PR #6 in particular re-aligns with gpu-operator's pattern), but only this PR addresses the actual abort.

Fixes: persistent repository-changed aborts since PR #4
Related: #5, #6

Type of Change

• Bug fix
• Build/CI/tooling

Implementation Notes

• One line + a comment explaining why we need it (so future PRs auditing permissions don't strip it again).

Testing

actionlint .github/workflows/renovate.yaml   # clean

Post-merge validation:

1. Delete orphan renovate/build-tools branch (will be re-created by next run with proper status check).
2. Single gh workflow run renovate.yaml --repo njhensley/aicr.
3. Expected: branch + PR + stability status check on the branch's commit, run completes with result: "renovate-pr-created" (or similar) instead of repository-changed.

Risk Assessment

• Low — Single permission addition. statuses: write lets the GITHUB_TOKEN write status checks on commits in this repo only; matches what gpu-operator's setup gets implicitly via the default permission set.

Checklist

• Linter passes (actionlint)
• I did not skip/disable tests to make CI green
• Commits are cryptographically signed (git commit -S)