@gitset-dev/cli 2.4.2 → 2.4.3

package/README.md

@@ -114,10 +114,13 @@ Secrets are redacted locally before any file content is sent, and prose
 docs / test file bodies are listed structurally but never sent at all.
 
 `gitset knowledge automate` needs "Allow GitHub Actions to create and
-approve pull requests" enabled under the repo's **Settings > Actions >
-General > Workflow permissions** — without it, the scheduled update still
-runs and commits safely, but the review-PR step fails, and the workflow run
-will show that failure clearly rather than hide it.
+approve pull requests" enabled (**Settings > Actions > General > Workflow
+permissions**) for the update PR to open. It detects this automatically and
+offers to enable it via the GitHub API — asked first, like everything else
+in this command. If you decline, or the API call fails (no admin access, an
+org policy locking the setting), the scheduled update still runs and
+commits safely; only the review-PR step fails, and the workflow run shows
+that failure clearly rather than hide it.
 
 ## Templates
 

package/lib/knowledge/ci.js

@@ -59,6 +59,16 @@ function buildKnowledgeWorkflow({ mode, provider, envKey, model, defaultBranch =
     '# permissions. Without it, the update still commits and pushes',
     '# safely, but opening the review PR fails and this job reports it',
     '# as a failure so it is never silently missed.',
+    '#',
+    '# If your organization enforces that setting off and it cannot be',
+    '# changed (the checkbox is greyed out even at the org level), add an',
+    '# optional repository secret GITSET_PR_TOKEN — a personal access',
+    '# token (classic: repo scope; fine-grained: Pull requests write) —',
+    '# and this workflow uses it instead of the default token, which is',
+    "# the standard workaround: an organization's PR-creation restriction",
+    '# applies to the auto-generated Actions token, not to a real PAT.',
+    '# No workflow changes needed after adding it — the next run picks it',
+    '# up automatically.',
     ...buildTrigger(mode, defaultBranch),
     'permissions:',
     '  contents: write',
@@ -81,7 +91,7 @@ function buildKnowledgeWorkflow({ mode, provider, envKey, model, defaultBranch =
     `        run: ${updateCmd}`,
     '      - name: Open a PR when the knowledge base changed',
     '        env:',
-    '          GH_TOKEN: ${{ github.token }}',
+    '          GH_TOKEN: ${{ secrets.GITSET_PR_TOKEN || github.token }}',
     '        run: |',
     '          if git diff --quiet -- docs/gitset-knowledge AGENTS.md; then',
     '            echo "Knowledge base already up to date."',
@@ -101,7 +111,7 @@ function buildKnowledgeWorkflow({ mode, provider, envKey, model, defaultBranch =
     '            echo "$PR_OUTPUT"',
     '          else',
     '            echo "$PR_OUTPUT"',
-    '            echo "::error::Could not open the pull request automatically (the branch and commit ARE safely pushed — no work was lost). This is usually because \'Allow GitHub Actions to create and approve pull requests\' is disabled for this repository: enable it under Settings > Actions > General > Workflow permissions, then either re-run this workflow or open the PR yourself: https://github.com/${{ github.repository }}/pull/new/gitset/knowledge-update"',
+    '            echo "::error::Could not open the pull request automatically (the branch and commit ARE safely pushed — no work was lost). Try, in order: (1) enable \'Allow GitHub Actions to create and approve pull requests\' under Settings > Actions > General > Workflow permissions; (2) if that checkbox is greyed out, your organization enforces it off — add a repository secret named GITSET_PR_TOKEN with a personal access token (repo scope) and re-run, no workflow change needed; (3) open the PR yourself: https://github.com/${{ github.repository }}/pull/new/gitset/knowledge-update"',
     '            exit 1',
     '          fi',
     '',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gitset-dev/cli",
-  "version": "2.4.2",
+  "version": "2.4.3",
   "description": "Gitset CLI — drafts commits, PRs, issues, READMEs and release notes with your own AI key. Fully local: your code and keys never touch a Gitset server. Draft. Refine. Ship.",
   "type": "commonjs",
   "bin": {

package/src/commands/knowledge.js

@@ -520,7 +520,8 @@ async function ensurePrPermission(repo, argv) {
     log('Enabled — CI will be able to open the review PR.', 'green');
     return 'enabled';
   } catch {
-    log('Could not change it automatically (you may not have admin access on this repo, or an organization policy may lock this setting).', 'yellow');
+    log('Could not change it automatically — you may not have admin access on this repo, or an organization policy locks this setting (if it appears greyed out in the GitHub UI at both the repo and org level, that\'s a hard enforcement you cannot toggle either way).', 'yellow');
+    log('Workaround: add a repository secret named GITSET_PR_TOKEN with a personal access token (repo scope). It is not subject to the organization\'s Actions PR-creation restriction, and the workflow picks it up automatically — no need to re-run automate.', 'dim');
     return 'failed';
   }
 }
@@ -610,6 +611,9 @@ async function runAutomate(rootDir, argv) {
       log('     GitHub repo > Settings > Actions > General > Workflow permissions', 'dim');
     }
     log('     Without this, the update still runs and commits safely — only opening the review PR fails, and the workflow run will show that failure clearly rather than hide it.', 'dim');
+    if (prPermission === 'failed') {
+      log('     If that checkbox is greyed out even at the organization level, it is enforced off and cannot be toggled: add a repository secret named GITSET_PR_TOKEN with a personal access token (repo scope) instead — the workflow uses it automatically, no changes needed.', 'dim');
+    }
   }
   log('  3. Make sure the knowledge base itself is committed (gitset knowledge generate, then commit docs/gitset-knowledge/ and AGENTS.md).', 'reset');
   log('  4. Commit and push the workflow file.', 'reset');