@sentry/junior-github 0.136.1 → 0.138.0

package/SETUP.md

@@ -1,6 +1,6 @@
 # GitHub plugin setup
 
-This plugin exposes two skills — `github-code` (clone, source-code investigation, pull requests) and `github-issues` (issue workflows). Junior uses GitHub App installation tokens for reads, workflow dispatches, allowlisted issue and pull request writes (including pull request reviews and inline review comments), and Git branch pushes. Human OAuth is reserved for explicitly personal operations such as user-attachment uploads.
+This plugin exposes two skills — `github-code` (clone, source-code investigation, pull requests) and `github-issues` (issue workflows). Junior uses GitHub App installation tokens for reads, workflow dispatches, reruns, and cancellations, allowlisted issue and pull request writes (including pull request reviews and inline review comments), and Git branch pushes. Human OAuth is reserved for explicitly personal operations such as user-attachment uploads.
 
 ## 1) Create/install GitHub App
 
@@ -182,7 +182,7 @@ new resources through the typed tools, for example
 Use `gh` for the allowlisted lifecycle operations described by the skill.
 
 `gh` supports either direct `GITHUB_TOKEN` (for local debugging) or sandbox-level header injection.
-The plugin uses installation credentials for read-only GitHub traffic, workflow dispatches, allowlisted issue and pull request mutations (including reviews and inline review comments), and Git smart-HTTP pushes. The installed GitHub App permissions still need to cover the operation: actions for workflow dispatches, issues for issue edits/comments/labels, contents for pushes, pull requests for PR mutations/reviews/inline comments, and workflows for workflow-file pushes.
+The plugin uses installation credentials for read-only GitHub traffic, workflow dispatches, reruns, and cancellations, allowlisted issue and pull request mutations (including reviews and inline review comments), and Git smart-HTTP pushes. The installed GitHub App permissions still need to cover the operation: actions for workflow dispatches, reruns, and cancellations, issues for issue edits/comments/labels, contents for pushes, pull requests for PR mutations/reviews/inline comments, and workflows for workflow-file pushes.
 
 Committing and pushing code uses more than one GitHub surface:
 
@@ -200,8 +200,8 @@ Be careful with mixed-surface PR commands. Use the allowlisted REST endpoints
 rather than GraphQL-backed `gh pr` mutation commands. PR-native title, body,
 base, state, ready-for-review, and requested-reviewer changes use pull request
 endpoints. Comments, labels, and assignees use GitHub's issue endpoints. All
-allowlisted bot writes share `installation-write`; merge, branch deletion, REST
-ref mutation, and administration remain unsupported API operations.
+allowlisted bot writes share `installation-write`; merge, branch deletion, REST ref
+mutation, and administration remain unsupported API operations.
 
 For PR creation in automation, push explicitly and pass that branch as `head`:
 

package/dist/index.js

@@ -4280,6 +4280,11 @@ function githubApiWriteGrantName(method, upstreamUrl) {
   )) {
     return "installation-write";
   }
+  if (method === "POST" && (/^\/repos\/[^/]+\/[^/]+\/actions\/runs\/[^/]+\/(cancel|rerun|rerun-failed-jobs)$/.test(
+    pathname
+  ) || /^\/repos\/[^/]+\/[^/]+\/actions\/jobs\/[^/]+\/rerun$/.test(pathname))) {
+    return "installation-write";
+  }
   if (method === "POST" && /^\/repos\/[^/]+\/[^/]+\/issues$/.test(pathname)) {
     return "installation-write";
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sentry/junior-github",
-  "version": "0.136.1",
+  "version": "0.138.0",
   "private": false,
   "publishConfig": {
     "access": "public"
@@ -31,7 +31,7 @@
     "@sinclair/typebox": "^0.34.49",
     "drizzle-orm": "^0.45.2",
     "zod": "^4.4.3",
-    "@sentry/junior-plugin-api": "0.136.1"
+    "@sentry/junior-plugin-api": "0.138.0"
   },
   "devDependencies": {
     "@types/node": "^25.9.1",

package/skills/github-code/references/api-surface.md

@@ -13,7 +13,7 @@ Treat explicit repo flags as command-targeting safety rails, not as a credential
 | Permission capability        | Commands                                                                             |
 | ---------------------------- | ------------------------------------------------------------------------------------ |
 | `github.actions.read`        | `gh run list`, `gh run view`, `gh run watch`, `gh workflow list`, `gh workflow view` |
-| `github.actions.write`       | `gh workflow run` only                                                               |
+| `github.actions.write`       | `gh workflow run`, `gh run rerun`, `gh run cancel`                                   |
 | `github.contents.read`       | `gh repo clone`, `git fetch`                                                         |
 | `github.contents.write`      | Git smart-HTTP `git push` only                                                       |
 | `github.workflows.write`     | Workflow-file changes carried by Git smart-HTTP push                                 |
@@ -38,6 +38,9 @@ Treat explicit repo flags as command-targeting safety rails, not as a credential
 | Stage and commit                   | `git -C DIRECTORY add -A && git -C DIRECTORY commit -m "message"`                                                        |
 | Push branch before PR creation     | `git -C DIRECTORY push -u origin BRANCH`                                                                                 |
 | Dispatch workflow                  | `gh workflow run WORKFLOW --repo owner/repo --ref REF [-f key=value]`                                                    |
+| Rerun workflow run                 | `gh run rerun RUN_ID -R owner/repo [--failed]`                                                                          |
+| Rerun workflow job                 | `gh run rerun --job JOB_ID -R owner/repo`                                                                               |
+| Cancel workflow run                | `gh run cancel RUN_ID -R owner/repo`                                                                                     |
 | Create pull request (draft)        | `github_createPullRequest({ repo: "owner/repo", head: "BRANCH", base: "BASE", title: "...", body: "...", draft: true })` |
 | Update pull request                | `gh api repos/owner/repo/pulls/NUMBER --method PATCH --input payload.json`                                               |
 | Mark ready for review              | `gh api repos/owner/repo/pulls/NUMBER/ready_for_review --method POST`                                                    |
@@ -72,7 +75,7 @@ jr-rpc config set github.repo owner/repo
 - If the commit changes workflow files under `.github/workflows`, the App installation needs Workflows write in addition to Contents write.
 - Before rebasing, merge-base analysis, blame/history inspection, or a base comparison, check whether the repository is shallow. Fetch a bounded depth of the base into `refs/remotes/origin/BASE`, deepen incrementally until the needed ancestry is present, and compare against `origin/BASE`; use `--unshallow` only when bounded deepening is insufficient. Never force-push to work around missing ancestry.
 - Before `github_createPullRequest`, push the head branch explicitly and resolve the target repo's default branch for `base`. That push requires GitHub write access to the remote.
-- Merge, fork creation, workflow reruns or cancellations, REST contents/Git database writes, and repository administration are outside the current write allowlist.
+- Merge, fork creation, REST contents/Git database writes, and repository administration are outside the current write allowlist.
 - Pull request reviews and inline review comments use the same repository-scoped `installation-write` credential as other bot-owned PR writes, so they post as Junior even on headless turns. Merge remains denied.
 - If the explicit `git push` fails with 401/403 or another access/permission error, verify the repo context and retry once. If it still fails, load troubleshooting guidance and report the exact command failure.
 - PR comments, labels, and assignees use GitHub's issue endpoints; use the `github-issues` REST guidance for those operations. All allowlisted bot writes share the same repository-scoped `installation-write` credential.