Base branch update has failed: refusing to allow a GitHub App to create or update workflow

[rix0rrr]

I have seen this behavior twice recently, on wildly different and unrelated GitHub repositories.

Example 1: https://github.com/aws/aws-cdk/pull/22890/checks?check_run_id=9497347123

Base branch update has failed

refusing to allow a GitHub App to create or update workflow .github/workflows/github-merit-badger.yml without workflows permission
err-code: 17CBF

I have seen the exact same error on this repository: https://github.com/hedyorg/hedy, though I can't find the PR anymore at the moment.

The error seems to occur when Mergify triggers a Branch Update action from the merge queue, when a GitHub workflow file has changed on main in the mean time.

I'm pretty sure this didn't use to happen, so something must have changed. Either the GitHub rules have changed, or something in the Mergify setup has.

Expected Behavior

The fork branch gets updated from main.

Actual Behavior

The fork branch is not updated.

Steps to Reproduce the Problem

1. Create a fork from a repo
2. Create a PR
3. Update any workflow file on the main repo
4. Embark the PR in the Mergify merge queue

Specifications

• Pull Request URL: chore(servicecatalogappregistry): providing default values for CreateApplicationTargetOptions aws/aws-cdk#22890
• Mergify Config URL: https://github.com/aws/aws-cdk/blob/main/.mergify.yml

[jd]

This is a GitHub App permission problem. If you log into your Mergify dashboard you should see a message requesting you to update the permission for the app.