What GitHub token permissions does the shared code context project need, and why does the pull request fail?

Tares needs a GitHub fine-grained token with Contents at Read and write, Pull requests at Read and write, and Metadata at Read-only, scoped to your source repositories and the context repository. GitHub starts every permission at Read-only, so if Pull requests stays there the agent can push its branch but the pull request fails. Check both access levels before you generate the token.

How it works

The Shared code context template, part of the AI SRE guides, watches commits across your code repositories. When commits land, an agent reads the change and updates the context pages that cover it. Tares handles the data side: one commits source per repository, one timeline per repository, and a trigger that fires when commits land. The agent reads and writes GitHub through GitHub’s hosted MCP server, registered with your credential, using the same token (toolsets repos,pull_requests).

The token has to cover two kinds of work, which is why it needs two write permissions:

Under Repository access, pick the source repositories and the context repository. The context repository cannot also be a source.

Why the pull request fails. When you add a permission, GitHub starts it at Read-only. Contents at Read and write lets the agent create a file on a branch named for the repository and the date, so the push succeeds. If Pull requests is still at Read-only, the next step, github__create_pull_request, is refused. You end up with a pushed branch and no pull request.

Set it up

1. In GitHub, open Settings, Developer settings, Personal access tokens, Fine-grained tokens, and start a new token.

2. Under Repository access, pick the source repositories and the context repository.

3. Under Repository permissions, set Contents to Read and write and Pull requests to Read and write. Leave Metadata at Read-only, since GitHub adds it for you.

4. Look at the access level of Contents and Pull requests once more before you generate the token. These are the two that default to Read-only.

5. Start Tares if it is not running yet.

   tares up

6. Open Projects, pick Shared code context and click Set up. Step 1 asks for the token. Pick a credential you stored before, or add one with a name and the token. The ”?” next to the token field repeats the permission table.

7. Click Test. It shows the GitHub login the token belongs to, so you can confirm it is the account you meant.

8. In step 2, tick the source repositories (up to 50) or paste owner/name lines. In step 3, pick the context repository, the branch pull requests target, and the path where the pages live.

9. Keep How it writes on open a pull request, then continue to step 4 and click Start.

The token is stored once under Settings > GitHub. Every source the project creates uses it, and so does the agent when it writes.

What you get

• A token scoped to exactly the repositories the project touches: the sources it reads and the context repository it writes.
• A context repository kept current by the commits themselves. When a change alters something a teammate or an agent in another repository must know, the agent writes the update on a branch and opens a pull request for a person to review.
• A finding on the repository’s timeline for every run: what changed and the pull request link, or “no update needed” and why. The project page shows these under What the agents found.
• A clear first check when a pull request does not appear. Compare the token’s Pull requests access against the table above. Read-only there is the failure the project warns about.

For the full walkthrough of the wizard, the page layouts and the first look run, see Keep shared code context current.

When something else fits

• Pull requests are the default and keep a person in the loop. Once you trust the agent for a repository, you can choose to commit straight to the branch instead.
• If you only want Tares to ingest commits from a repository and not have an agent write to it, the GitHub connector page covers the commits source and its stored credential.

Related