Unexpected TagBot failures in JuliaCollections org

[fingolfin]

(This is different from issue #384).

I've been trying since today (March 18, 2025) to get TagBot working again for several packages in the JuliaCollections org, including

• https://github.com/JuliaCollections/DataStructures.jl
• https://github.com/JuliaCollections/LRUCache.jl
• and more

In particular ...

• made sure a deploy key with "write" permission is set (created with DocumenterTools.genkeys(user="JuliaCollections", repo="LRUCache.jl") etc.)
• ensured DOCUMENTER_KEY matches
• verified GitHub action settings are permissible enough, i.e.
  
• ensure .github/workflows/TagBot.yml matches the currently recommended one

Despite all this, I get TagBot failures and am now at a loss what might be the cause. For example I tried to release LRUCache.jl, which worked, but TagBot then errored out. Excerpt from the full log:

Processing version v1.6.2 (9abf4191a852324e8edd2a17798c77dede9fea5b)
Generating changelog for version v1.6.2 (9abf4191a852324e8edd2a17798c77dede9fea5b)
Creating release v1.6.2 at 9abf4191a852324e8edd2a17798c77dede9fea5b
Request POST /repos/JuliaCollections/LRUCache.jl/releases failed with 403: Forbidden
HTTPHeaderDict({'Date': 'Tue, 18 Mar 2025 13:40:10 GMT', 'Content-Type': 'application/json; charset=utf-8', 'X-GitHub-Media-Type': 'github.v3; format=json', 'x-accepted-github-permissions': 'contents=write; contents=write,workflows=write', 'x-github-api-version-selected': '2022-11-28', 'X-RateLimit-Limit': '5000', 'X-RateLimit-Remaining': '4945', 'X-RateLimit-Reset': '1742308697', 'X-RateLimit-Used': '55', 'X-RateLimit-Resource': 'core', 'Access-Control-Expose-Headers': 'ETag, Link, Location, Retry-After, X-GitHub-OTP, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Used, X-RateLimit-Resource, X-RateLimit-Reset, X-OAuth-Scopes, X-Accepted-OAuth-Scopes, X-Poll-Interval, X-GitHub-Media-Type, X-GitHub-SSO, X-GitHub-Request-Id, Deprecation, Sunset', 'Access-Control-Allow-Origin': '*', 'Strict-Transport-Security': 'max-age=31536000; includeSubdomains; preload', 'X-Frame-Options': 'deny', 'X-Content-Type-Options': 'nosniff', 'X-XSS-Protection': '0', 'Referrer-Policy': 'origin-when-cross-origin, strict-origin-when-cross-origin', 'Content-Security-Policy': "default-src 'none'", 'Vary': 'Accept-Encoding, Accept, X-Requested-With', 'Content-Encoding': 'gzip', 'Transfer-Encoding': 'chunked', 'X-GitHub-Request-Id': '1C00:2F0737:AD2226:15C1545:67D977B9', 'Server': 'github.com'})
Error: GitHub returned a 403 permissions-related error.
                    Please check that your ssh key and TagBot permissions are up to date
                    https://github.com/JuliaRegistries/TagBot#setup
                    

So it managed to create the tag but not the release.

Any thoughts what might be the cause or how to overcome this?

[fingolfin]

I tracked it down: it is caused by this:

permissions:
  actions: read
  checks: read
  contents: write
  deployments: read
  issues: read
  discussions: read
  packages: read
  pages: read
  pull-requests: read
  repository-projects: read
  security-events: read
  statuses: read

If I remove this from the TagBot config, creating the release works.

So my guess is that GitHub recently changed which permissions are relevant... that means the TagBot README should be adjusted to say what works now (I have no idea which settings needs to be added/changed, I just chucked all of the above). And I guess a lot more projects might be affected by this in the end...

[fingolfin]

I am not sure who is "in charge" of TagBot -- this is biting a lot of people and more projects are broken each time someone wants to be helpful and update a projects TagBot config to the latest and greatest (not knowing that it is broken).