From 3faa47bca1a47bab4e637132c09c8d0f9a8e7606 Mon Sep 17 00:00:00 2001
From: Steven Enamakel <31011319+senamakel@users.noreply.github.com>
Date: Sat, 9 May 2026 14:31:40 -0700
Subject: [PATCH] Fix/rabbit 3 (#1428)

---
 .github/workflows/rabbit-retrigger.yml | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/.github/workflows/rabbit-retrigger.yml b/.github/workflows/rabbit-retrigger.yml
index d4e406b57..fbce806c7 100644
--- a/.github/workflows/rabbit-retrigger.yml
+++ b/.github/workflows/rabbit-retrigger.yml
@@ -50,6 +50,28 @@ jobs:
         uses: actions/setup-node@v4
         with:
           node-version: 24.x
+      - name: Diagnose App token identity
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+        run: |
+          set -e
+          echo "== gh auth status =="
+          gh auth status || true
+          echo
+          echo "== App installation identity =="
+          # `/installation/repositories` works for an installation access token
+          # and confirms which repos the App can write to. If this doesn't list
+          # tinyhumansai/openhuman or shows zero permissions, the App isn't
+          # installed on the repo (or the new perms haven't been accepted yet).
+          gh api /installation/repositories \
+            --jq '{total_count, perms: .repositories[0].permissions, repos: [.repositories[].full_name]}' \
+            || echo "(installation listing failed)"
+          echo
+          echo "== Posting permission probe =="
+          # GET on the comments endpoint requires `issues:read` (or pull-requests:read).
+          # POST requires `issues:write`. We only GET here so we don't pollute PRs.
+          gh api -i /repos/${GITHUB_REPOSITORY}/issues/1421/comments?per_page=1 \
+            2>&1 | head -20 || true
       - name: Run rabbit
         env:
           GH_TOKEN: ${{ steps.app-token.outputs.token }}