Heroku Pipelines: You need to have the deploy or operate permission on this app

Question

I've inherited an app hosted on Heroku which uses review apps. Right up until the day before I took over responsibility for the system, the review apps were working absolutely fine, pulling in the branch, building it, then using a postdeploy command to pull in a database backup from the staging server.

Then I started, and all of a sudden, it's not working. I don't know if this is related to something I've done (which at this point is very little), or maybe an actual permissions issue (I've been set-up as an admin on everything, although the other developers, who this was working for before, are also unable to complete it) but the final step of pulling in the database is failing:

I'm at a complete loss as to what's going wrong here.

Below is the app.json file being used, and the $HEROKU_DATABASE_RESTORE is set to clixifix-staging-eu::b530 (which is the staging server::backup file).

{
  "buildpacks": [
    { "url": "heroku/nodejs" },
    { "url": "heroku/ruby" },
    { "url": "heroku-community/nginx" }
  ],

  "environments": {
    "review": {
      "addons": [
        {
          "plan": "heroku-postgresql:hobby-basic",
          "options": {
            "version": "9.6"
          }
        },

        { "plan": "memcachedcloud:30" },
        { "plan": "mailtrap:unpaid" }
      ],

      "buildpacks": [
        { "url": "heroku/nodejs" },
        { "url": "heroku/ruby" },
        { "url": "heroku-community/nginx" },
        { "url": "heroku-community/cli" }
      ],

      "env": {
        "SECRET_KEY_BASE": {
          "generator": "secret"
        }
      },

      "formation": {
        "web": {
          "quantity": 1,
          "size": "hobby"
        },

        "generalworker": {
          "quantity": 1,
          "size": "hobby"
        },

        "reportworker": {
          "quantity": 1,
          "size": "hobby"
        }
      },

      "scripts": {
        "postdeploy": "heroku pg:backups:restore $HEROKU_DATABASE_RESTORE DATABASE_URL -a $HEROKU_APP_NAME --confirm $HEROKU_APP_NAME"
      }
    }
  }
}

Answer 1

I reached out to Heroku, who gave me the answer I needed:

What the issue is most likely for the error in the postdeploy, is that to run:

heroku pg:backups:restore $HEROKU_DATABASE_RESTORE DATABASE_URL -a $HEROKU_APP_NAME --confirm $HEROKU_APP_NAME

You will need a platform API key stored somewhere withing your pipeline review app config vars so the CLI can log in. The user who this API key belongs to has most likely lost access to your team and doesn't have permissions to access your review apps. You should generate a new API key using heroku authorizations:create and update it on your pipeline.

Basically, when the old guy left, his permissions were revoked, causing the error. I generated a new key using the command above, set the token as the HEROKU_API_KEY value within the envars in the review app settings, and it worked.