fix(budget): request the billing permission and say so when it is missing - #130
Merged
Conversation
…sing The first real run reached the billing endpoint and got 403 "Resource not accessible by integration", while the same App token happily listed all 33 repos in the org. Billing sits behind its own App permission -- "Organization plan", read-only -- which the token was never asking for. Requesting it here is necessary but not sufficient: the App must also have been granted that permission and the updated installation permissions accepted, which is an owner action rather than something a workflow can do. So the failure message now names the actual cause and the remedy instead of the vague "endpoint or token scope may have changed", and points out the diagnostic that gives it away: repo listing succeeding while billing 403s is precisely this and nothing else. It also records that the classic billing endpoint is gone (410), so nobody re-diagnoses that from scratch. The watchdog still fails loud rather than reporting zero when it cannot read the budget. A budget watchdog that quietly reports 0% because it lost access is worse than an absent one: it looks like good news. Refs #126
This was referenced Aug 29, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What the first real run showed
Billing sits behind its own App permission — "Organization plan", read-only — which the token was never requesting. My local PAT could read the endpoint, which is why this passed local verification and failed in CI.
Fix, and what it does not fix
permission-organization-plan: readis now requested. That is necessary but not sufficient: the App must also have been granted that permission, and the updated installation permissions accepted. That is an owner action — see the note in JorisJonkers-dev/.github#126.Alternative if you would rather not touch the App: supply
BUDGET_TOKEN, a token with org billing read access. The workflow already prefers it over the App token.Better failure message
The old text — "the endpoint or token scope may have changed" — sent you nowhere. It now names the cause, the remedy, and the diagnostic that gives it away: repo listing succeeding while billing 403s is precisely this and nothing else. It also records that the classic
/orgs/{org}/settings/billing/actionsendpoint is gone (410), so nobody re-derives that.Still fails loud
The watchdog exits non-zero when it cannot read the budget, rather than reporting 0%. A budget watchdog that quietly reports 0% because it lost access is worse than an absent one — it looks like good news.