The alpha release workflow was failing at the final step when trying to trigger the stage-2 build workflow with the error:

could not create workflow dispatch event: HTTP 403: Resource not accessible by integration

This occurred because the workflow was using the default github.token instead of the privileged secrets.GH_TOKEN to trigger another workflow. GitHub requires elevated permissions to trigger workflows from other workflows for security reasons.

Root Cause

In .github/workflows/release-stage-1_update_dependencies.yml, the "Trigger Build and Release" step was configured with:

env:
  GH_TOKEN: ${{ github.token }}  # Insufficient permissions

The default github.token lacks the necessary permissions to dispatch other workflows, resulting in HTTP 403 errors.

Fix

Changed the token reference to use the privileged token that's already configured elsewhere in the same workflow:

- GH_TOKEN: ${{ github.token }}
+ GH_TOKEN: ${{ secrets.GH_TOKEN }}

This change makes the workflow dispatch step consistent with the homebridge-bot step on line 61, which already uses secrets.GH_TOKEN for PR operations that require elevated permissions.

Impact

This minimal one-line change will allow the alpha, beta, and stable dependency update workflows to successfully trigger the stage-2 build workflows after completing dependency updates and PR merges. The multi-stage release process will now complete end-to-end without permission errors.

Fixes #206.

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.