docs(agent): the buildkite plugin needs a ci-scoped key, which the page did not say

[mergify-ci-bot]

The page told readers the plugin reads "your application key" from
MERGIFY_TOKEN, without saying which scope that key needs. Application keys
carry one of two scopes and the scopes-upload endpoints accept only ci; an
admin key is rejected. A reader who picks the more powerful-sounding scope
gets a plugin that detects scopes correctly, writes its meta-data correctly,
skips the right steps, and then fails to upload — which is the one part of the
chain the merge queue actually consumes.

The omission is worth closing now rather than later because the Terraform page
gained the opposite instruction in the same change: its provider needs an
admin key, and it says so. A reader holding one key and reading both pages had
nothing to tell them the two integrations want different scopes.

The sentence now names the ci scope and links the scopes reference, in the
same form merge-queue/scopes.mdx already uses for the equivalent REST call.
Nothing else on the page changes; the surrounding explanation of what a missing
token costs was already correct.

Evidence: the security scheme the scopes endpoints declare in the API schema,
and the published scope table for application keys.

[mergify]

Merge Protections

🟠 1 of 6 protections blocking · waiting on 🤖 CI

	Protection	Waiting on
🟠	🤖 Continuous Integration	🤖 CI
🟢	👀 Review Requirements	—
🟢	Enforce conventional commit	—
🟢	🔎 Reviews	—
🟢	📕 PR description	—
🟢	🚦 Auto-queue	—

🟠 🤖 Continuous Integration

Waiting for

• check-success = diagram-tokens

Waiting checks: diagram-tokens.

• all of:
  • check-success = diagram-tokens
  • check-success = build
  • check-success = lint
  • check-success = test
  • any of:
    • check-success = test-broken-links
    • label = ignore-broken-links
  • any of:
    • -head-repo-full-name~=^Mergifyio/
    • check-success=Cloudflare Pages

---

Show 5 satisfied protections

🟢 👀 Review Requirements

• any of:
  • #approved-reviews-by >= 2
  • author = dependabot[bot]
  • author = renovate[bot]
  • all of:
    • -head ~= ^docs-agent/
    • author = mergify-ci-bot

🟢 Enforce conventional commit

Make sure that we follow https://www.conventionalcommits.org/en/v1.0.0/

• title ~= ^(fix|feat|internal|docs|style|refactor|perf|test|build|ci|chore|revert|ui)(?:\(.+\))?!?:

🟢 🔎 Reviews

• #changes-requested-reviews-by = 0
• #review-requested = 0
• #review-threads-unresolved = 0

🟢 📕 PR description

• body ~= (?ms:.{48,})

🟢 🚦 Auto-queue

When all merge protections are satisfied, this pull request will be queued automatically.

[mergify]

Merge Queue Status

• ✅ Entered queue — 2026-09-09 11:52 UTC · Rule: default · triggered by merge protections
• ✅ Checks passed · on draft merge queue: checking #12749 on main (4b828c1), stacked on #12748, #12648 and #12751 #12756
• ✅ Merged — 2026-09-09 11:58 UTC · at a05703d1d384f4546c3b8d0f89d0917240c48401 · squash

This pull request spent 6 minutes 8 seconds in the queue, including 3 minutes 36 seconds running CI.

Required conditions to merge

• github-review-approved [🛡 GitHub repository ruleset rule Require pull request for default branch]
  • docs(agent): the buildkite plugin needs a ci-scoped key, which the page did not say #12749
• schedule=Mon-Fri 09:00-17:30[Europe/Paris]
• all of [🛡 Merge Protections rule Enforce conventional commit]:
  • title ~= ^(fix|feat|internal|docs|style|refactor|perf|test|build|ci|chore|revert|ui)(?:\(.+\))?!?:
    • docs(agent): the buildkite plugin needs a ci-scoped key, which the page did not say #12749
• all of [🛡 Merge Protections rule 👀 Review Requirements]:
  • any of:
    • #approved-reviews-by >= 2
      • docs(agent): the buildkite plugin needs a ci-scoped key, which the page did not say #12749
    • author = dependabot[bot]
      • docs(agent): the buildkite plugin needs a ci-scoped key, which the page did not say #12749
    • author = renovate[bot]
      • docs(agent): the buildkite plugin needs a ci-scoped key, which the page did not say #12749
    • all of:
      • -head ~= ^docs-agent/
        • docs(agent): the buildkite plugin needs a ci-scoped key, which the page did not say #12749
      • author = mergify-ci-bot
        • docs(agent): the buildkite plugin needs a ci-scoped key, which the page did not say #12749
• all of [🛡 Merge Protections rule 📕 PR description]:
  • body ~= (?ms:.{48,})
    • docs(agent): the buildkite plugin needs a ci-scoped key, which the page did not say #12749
• all of [🛡 Merge Protections rule 🔎 Reviews]:
  • #changes-requested-reviews-by = 0
    • docs(agent): the buildkite plugin needs a ci-scoped key, which the page did not say #12749
  • #review-requested = 0
    • docs(agent): the buildkite plugin needs a ci-scoped key, which the page did not say #12749
  • #review-threads-unresolved = 0
    • docs(agent): the buildkite plugin needs a ci-scoped key, which the page did not say #12749
• all of [🛡 Merge Protections rule 🤖 Continuous Integration]:
  • all of:
    • check-success = build
    • check-success = lint
    • check-success = test
    • any of:
      • check-success = test-broken-links
      • label = ignore-broken-links
        • docs(agent): the buildkite plugin needs a ci-scoped key, which the page did not say #12749
    • any of:
      • -head-repo-full-name~=^Mergifyio/
        • docs(agent): the buildkite plugin needs a ci-scoped key, which the page did not say #12749
      • check-success=Cloudflare Pages