[DerekNonGeneric]

Yes — the same gap is here, in a file that is byte-identical to the
one in OpenINF/.github before
#896 fixed it.

The gap

Both steps that report back to a pull request are gated on the app token:

- name: Take the label back off
  if: always() && steps.token.outcome == 'success'

- name: Say why it did not land
  if: failure() && steps.token.outcome == 'success'

They have to be — reporting takes a token. But a token that never mints
therefore produces a bare red Land check, no comment, and the label
still sitting on the pull request as though the queue had not looked.

How much it matters here, honestly

Less than it does in .github, and I checked rather than assuming:

• The queue works here today. It has landed everything on live for
  weeks, most recently 🏗️🔧：quote paths, read JSON5, fix the EC binary #1881.
• The label removal works too — no merged pull request is left wearing
  🚀 Status: Commit Queue, which means the app really does hold the
  permission that endpoint needs.

So this is insurance, not a repair. It stops being insurance the day the
private key is rotated, the app is uninstalled from this repository, or
a secret is cleared — and on that day the only signal is a red check
with nothing to read.

Also: a comment that is wrong

The note above those steps claims they "need only the pull request
permission the app already has". They do not — labels and comments are
issue endpoints even when the number belongs to a pull request, so they
need Issues: write, per GitHub's permissions reference.

This app satisfies it, which is precisely the case the note warns about
two lines earlier: "tightening its permissions … would break these
silently behind the || true." Someone acting on the wrong sentence
while tightening the app is how that happens.

No permissions change. The job keeps contents: read; widening
GITHUB_TOKEN just to post a failure comment is a larger surface than
this warrants on a pull_request_target workflow.

Summary by CodeRabbit

• Documentation
  • Clarified that label and comment actions require appropriate issue-management permissions.
  • Improved workflow error messages when authentication fails, including confirmation that the pull request label remains unchanged.

[netlify]

✅ Deploy Preview for gh-pages-openinf ready!

Name	Link
🔨 Latest commit	221ab79
🔍 Latest deploy log	https://app.netlify.com/projects/gh-pages-openinf/deploys/6a9dd3e4a768d8000852f008
😎 Deploy Preview	https://deploy-preview-1882--gh-pages-openinf.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 962639c3-c6a6-4e62-927a-5f0c3c18ce97

📥 Commits

Reviewing files that changed from the base of the PR and between 3d17c64 and 221ab79.

📒 Files selected for processing (1)

• .github/workflows/commit-queue.yml

Included review availability: Your plan provides up to 8 included reviews per hour; 7 remain after this review.

---

📝 Walkthrough

Walkthrough

The commit queue workflow documents its required Issues: write permission and reports app token creation failures while confirming that no queue work occurred.

Changes

Commit queue workflow

Layer / File(s)	Summary
Permission and failure reporting .github/workflows/commit-queue.yml	The workflow documents the app permission for label and comment REST endpoints. A fallback step emits an error annotation when token creation fails and confirms that the queue label remains applied.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 221ab

The workflow adds credential-independent failure reporting and clarifies the permission required for queue label and comment operations. No current merge-readiness risk is identified.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: the commit queue now explains why it could not start. The emojis add minor noise but do not prevent clear understanding.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch infra/queue-explains-itself

---

_{Comment @coderabbitai help to get the list of available commands.}