This has come back to bite me already 🤷‍♂️

https://github.com/jcbhmr/devcontainer-features/actions/runs/4267459350/jobs/7429085875

So I need to:

• Make it so that the devcontainer publish gets the packages write scope
• Make it so that the wiki action gets the write repo scope AND the wiki scope (whatever it's called)

Turns out there is no wiki specific one that I could find?

permissions:
  actions: read|write|none
  checks: read|write|none
  contents: read|write|none
  deployments: read|write|none
  id-token: read|write|none
  issues: read|write|none
  discussions: read|write|none
  packages: read|write|none
  pages: read|write|none
  pull-requests: read|write|none
  repository-projects: read|write|none
  security-events: read|write|none
  statuses: read|write|none

I think it must be the contents: write which does it?

Yep for the wiki!

The publish action still doesn't work 🤔

https://github.com/devcontainers/feature-starter/blob/0937a6939a8c9c75a54171981fb8fc169586109b/.github/workflows/release.yaml#L5-L14

jobs:
  deploy:
    if: ${{ github.ref == 'refs/heads/main' }}
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write
      packages: write
    steps:
      - uses: actions/checkout@v3

Maybe it has to be contents: write too?

Even with the stock-standard feature-starter workflow I can't get it to work...

Turns out the easiest way to fix it is to just give up an use permissions: write-all and be done with it. Maybe someone can enlighten me which permissions I need to enable?

devcontainers/community#30 (comment)

Accidentally closed in an attempt to fix.

The permissions: write-all worked for a demo repo, but didn't work here for some reason. I don't know why. I think the best course of action is just to give up and use a secret GITHUBX_TOKEN from a manually created access token.

Even using the official workflow with permissions: write-all fails 😢

Since I figured I don't want to have to every 30 days change the token, I thought that now is the time before there's more than 3 issues to transfer everything to a new repo. So I did. This is a new repo that DOES have the generated from tag, but also magically works now. So yeah, worth it! That is, if it ends up working...

Solved as "good enough": just use the generated one and it works OK. Don't completely know why, but 🤷‍♂️