🚨 CI Failure: Check Submodule Updates (main)

[github-actions]

Workflow: Check Submodule Updates
Branch: main
Run: #54
Failed at: 2026-07-06T07:39:25Z
Commit: bca8940

This issue was automatically opened because the Check Submodule Updates workflow failed on main.

🔍 View workflow run

---

Updated at 2026-07-06T07:39:47.241Z

[dianlight]

/oc check the error an proprose a solutio

[github-actions]

🔁 Failed again on run #51. Issue updated with latest failure details.

[github-actions]

🔁 Failed again on run #52. Issue updated with latest failure details.

[github-actions]

🔁 Failed again on run #53. Issue updated with latest failure details.

[github-actions]

🔁 Failed again on run #54. Issue updated with latest failure details.

[dianlight]

/oc verify why the action fails

[github-actions]

Analysis & Proposal

Summary

The Check Submodule Updates workflow (update-submodule.yml) fails consistently in the check-drivedb job because the default GITHUB_TOKEN lacks permission to create pull requests from a schedule-triggered workflow.

Related issues/PRs

• PR Update drivedb.h from upstream drivedb/7.5 #1 (merged) — The previous drivedb.h update was created manually by @dianlight, not by the workflow. This confirms the workflow has never been able to create PRs autonomously.

Root cause

The error at update-submodule.yml:96:

pull request create failed: GraphQL: GitHub Actions is not permitted to create or approve pull requests (createPullRequest)

The GITHUB_TOKEN provided by GitHub Actions is restricted from performing createPullRequest via the GraphQL API when the workflow is triggered by schedule. The push to the branch succeeds (the token has contents: write), but the gh pr create step fails because pull-requests: write is insufficient for PR creation via GraphQL in this trigger context — this is a documented GitHub limitation.

The check-update job has the same code path (gh pr create at line 58) and would also fail if it ever found a new upstream release tag.

Proposed solution

Option A (recommended): Use a Personal Access Token

1. Create a fine-grained PAT with pull-requests: read/write and contents: read/write permissions, or a classic PAT with repo scope.
2. Add it as a repository secret named e.g. WORKFLOW_PAT.
3. Replace ${{ secrets.GITHUB_TOKEN }} with ${{ secrets.WORKFLOW_PAT }} in the GH_TOKEN env var of the Create Pull Request step in both the check-update and check-drivedb jobs.

Option B: Toggle repo settings
Enable Allow GitHub Actions to create and approve pull requests under Settings > Actions > General > Workflow permissions. This is simpler but may have broader org-policy implications.

Edge cases to handle:

• If WORKFLOW_PAT is not set, the workflow should fail gracefully (the current hard failure after a successful branch push is acceptable but noisy).
• The check-update job has never been tested with a real update — it should be verified manually once the fix is applied.

Files to change:

• .github/workflows/update-submodule.yml — change secrets.GITHUB_TOKEN → secrets.WORKFLOW_PAT in the two GH_TOKEN environment variable references.

Risks / tradeoffs

• A PAT secret must be created and maintained (rotated periodically).
• Using a PAT in a public repo is safe as long as the token has only the minimal required scopes.
• If the repo setting is toggled instead, a future GitHub policy change could re-break the workflow.

Request

Reply "approved" (or submit an Approve review) if you want this implemented, and I will have the implementation workflow produce a PR with the changes.

[github-actions]

Analysis posted as comment. The check-drivedb job fails because GITHUB_TOKEN can't create PRs from schedule-triggered workflows — the fix is a Personal Access Token. Awaiting your reply.

opencode session  |  github run

[github-actions]

✅ The Check Submodule Updates workflow run #54 succeeded on main. Closing this issue.