[yeti-error] ci-fixer:rerun

[frostyardyeti]

Auto-created by Yeti error reporter
Fingerprint: ci-fixer:rerun
Context: frostyard/chairlift#10
Timestamp: 2026-03-27T14:00:56.783Z

Error: gh run rerun 23649885994 --repo frostyard/chairlift failed: run 23649885994 cannot be rerun; Resource not accessible by integration

    at file:///opt/yeti/dist/github.js:309:28
    at ChildProcess.exithandler (node:child_process:424:5)
    at ChildProcess.emit (node:events:519:28)
    at maybeClose (node:internal/child_process:1101:16)
    at ChildProcess._handle.onexit (node:internal/child_process:304:5)
    at Process.callbackTrampoline (node:internal/async_hooks:130:17)

[frostyardyeti]

— Automated by Yeti —

Yeti Error Investigation Report

I have all the information needed. Here is the investigation report.

---

Investigation Report: ci-fixer:rerun (Issue #193)

Verified Root Cause

The error is a GitHub App permissions issue. The gh run rerun command requires the actions:write permission, but the GitHub App installation token being used to authenticate does not have this permission for frostyard/chairlift.

The error message has two parts separated by a semicolon:

1. run 23649885994 cannot be rerun — the gh CLI's framing
2. Resource not accessible by integration — the GitHub API's standard 403 response when a GitHub App token lacks required permissions

Evidence

1. Error path — src/github.ts:1198-1199: rerunWorkflow() calls gh(["run", "rerun", runId, "--repo", repo]) with no special error handling.

2. Catch handler only covers "already running" — src/jobs/ci-fixer.ts:550-556: The rerun error handler checks for /already running/i and silently skips those. Any other error (including this permissions error) falls through to reportError("ci-fixer:rerun", ...), creating the [yeti-error] issue.

3. "Resource not accessible by integration" is GitHub's standard error when a GitHub App installation token lacks the required scope. gh run rerun requires actions:write on the target repository. This is not a transient error — it will recur on every ci-fixer cycle for any repo where the App lacks this permission.

4. Not handled by transient retry — The TRANSIENT_RE pattern in github.ts does not match "Resource not accessible by integration", so the gh() function correctly does not retry it. However, the ci-fixer rerun handler also doesn't recognize it as a known non-transient condition.

Recommended Fix

Two complementary changes:

1. Operational fix (primary): Add actions:write permission to the GitHub App's installation for frostyard/chairlift (and any other repos where ci-fixer should be able to rerun workflows). This is configured in the GitHub App settings under "Repository permissions > Actions > Read and write".

2. Code fix (defensive): Add "cannot be rerun" or "Resource not accessible by integration" to the benign error patterns in the ci-fixer rerun handler, alongside the existing "already running" check. These are non-retriable conditions that should be logged as warnings rather than creating [yeti-error] issues. Specifically, in src/jobs/ci-fixer.ts around line 551:

// Current:
if (err instanceof Error && /already running/i.test(err.message)) {

// Proposed:
if (err instanceof Error && /already running|cannot be rerun|Resource not accessible/i.test(err.message)) {

This prevents error noise from permission-limited repos while the operational fix is applied. The log message at line 552 could also be made more generic (e.g., "skipping rerun" instead of "is already running").

[frostyardyeti]

— Automated by Yeti —

Implementation Plan

I have all the context I need. Here's the plan:

---

Implementation Plan

Summary

Handle the "Resource not accessible by integration" and "cannot be rerun" errors in ci-fixer's rerun handler as benign (non-retriable) conditions, logging a warning instead of creating [yeti-error] issues. This is a small, focused change: widen the existing regex in the catch block and generalize the log message.

Changes

1. src/jobs/ci-fixer.ts (line 551–552)

Modify the rerun error handler regex and log message:

• Line 551: Change /already running/i to /already running|cannot be rerun|Resource not accessible/i to match the two new non-retriable error patterns alongside the existing one.
• Line 552: Generalize the log message from "is already running, skipping rerun" to "skipping rerun" (or similar) since the error is no longer exclusively about "already running". Keep it at log.info level since these are expected operational conditions.

Why: The "Resource not accessible by integration" error is a permanent permissions condition (not transient), and "cannot be rerun" is a GitHub-side refusal. Neither will resolve on retry, so they should not generate [yeti-error] issues. They should be logged for observability.

2. src/jobs/ci-fixer.test.ts

Add one test case after the existing "rerun silently skips when workflow is already running" test (around line 151):

• Test name: "rerun silently skips when resource is not accessible by integration"
• Setup: Same as the existing "already running" test but with mockGh.rerunWorkflow.mockRejectedValue(new Error("run 555 cannot be rerun; Resource not accessible by integration"))
• Assert: rerunWorkflow was called, reportError was NOT called.

Why: Mirrors the existing test pattern and verifies the new error pattern is handled correctly.

Implementation order

1. Modify src/jobs/ci-fixer.ts (the handler change)
2. Add test in src/jobs/ci-fixer.test.ts
3. Run npx vitest run src/jobs/ci-fixer.test.ts to verify

Risks and edge cases

• Overly broad regex: Resource not accessible could theoretically match a different error in a different context. However, this catch block is scoped specifically to rerunWorkflow calls, so the risk of false positives is minimal.
• Silent swallowing: These errors are logged at info level, which is appropriate since they're expected operational conditions. If debugging is needed, the log entry will be present.
• Operational fix still needed: This code change only suppresses the error noise. The actions:write permission still needs to be added to the GitHub App for repos where ci-fixer should actually rerun workflows. That is an operational task outside this PR's scope.

[frostyardyeti]

— Automated by Yeti —

Plan Review

The plan has a few gaps.

1. Suppressing these rerun failures without any backoff/state change creates a permanent retry loop. identifyPRWork() turns cancelled checks into kind: "rerun" every sweep, and the rerun path at run() has no memoization or suppression after a refusal. If gh run rerun is permanently impossible for that repo/app, this change will make ci-fixer keep retrying forever every job interval, just with quieter logs instead of a [yeti-error]. The plan mentions the operational permission fix, but not this repeated-attempt behavior.

2. The proposed regex is broader than the issue warrants. Matching /Resource not accessible/i at src/jobs/ci-fixer.ts:551 would also swallow other access/auth failures in the rerun path, not just the specific GitHub App case from the issue. If this is meant to suppress only the known benign case, it should match the exact phrase Resource not accessible by integration rather than the broader substring.

3. The test plan is too narrow. The new test only covers the combined message, while the code change claims to handle two distinct new benign conditions: cannot be rerun and Resource not accessible by integration. The existing rerun-skip test at src/jobs/ci-fixer.test.ts:134 also does not assert the log side effect. If logging is the replacement for error reporting, the tests should verify that a log entry is emitted, and ideally cover the bare cannot be rerun variant separately.

4. If the intent is to generalize rerun logging, the plan missed another inaccurate log message. The rerun worker logs Re-running cancelled check at src/jobs/ci-fixer.ts:548, but kind: "rerun" is also used for the “no failure logs” path at src/jobs/ci-fixer.ts:210. If they are already generalizing the skip log, they should decide whether this pre-rerun log should also be generalized.

[frostyardyeti]

— Automated by Yeti —

Recurrence — 2026-03-27T14:35:37.287Z

Context: frostyard/chairlift#13

Error: gh run rerun 23650685583 --repo frostyard/chairlift failed: run 23650685583 cannot be rerun; Resource not accessible by integration

    at file:///opt/yeti/dist/github.js:309:28
    at ChildProcess.exithandler (node:child_process:424:5)
    at ChildProcess.emit (node:events:519:28)
    at maybeClose (node:internal/child_process:1101:16)
    at ChildProcess._handle.onexit (node:internal/child_process:304:5)
    at Process.callbackTrampoline (node:internal/async_hooks:130:17)