Fix trusted local audit publication permission

[jeffhuber]

The trusted local-audit publisher successfully verifies sealed reviewer metadata, then fails before creating its reservation comment because the workflow token has only read access to pull requests. GitHub authorizes comments on pull requests through the Pull requests permission even though the REST route is under Issues.

This grants the publication workflow pull-requests: write alongside its existing issues: write, keeps every other permission unchanged, and updates both generated template mirrors. A focused regression guards the permission in addition to the existing workflow trust-boundary checks.

Validation:

• 33 focused tests and 293 subtests passed
• privacy scan passed
• package workflow guard passed
• all 13 generated workflows passed actionlint
• template mirrors match
• diff check passed

The previous immutable candidate is invalidated by this release-critical fix. No tag, package publication, hosted provider session, paid canary, or deployment is performed by this PR.

[gitar-bot]

Note

Automatic reviews are paused because your team has used its included automatic processing for this billing period (headroom scales with your seat count). You can still comment "Gitar review" to run one anytime, and automatic reviews resume on their own by October 1. Add seats for more headroom.
Learn more

Code Review ✅ Approved

🟡 Medium risk

Grants the trusted local-audit publisher pull-requests: write permission to fix comment creation on pull requests, which was previously blocked by read-only access. All validation checks passed, including 33 focused tests with 293 subtests, privacy scan, and actionlint verification.

Review coverage

Rules No rules evaluated

Functional validation Not enabled · Set up

Options

Display: compact → Counting what did not apply, without listing it.

Comment with these commands to change the behavior for this request:

Compact

gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[jeffhuber]

Owner gate override for exact head d77a23ea2e6a9796391b44b37bbe9208758fdab3.

• Independent Claude audit source run 35331014637 produced the successful reviewer seal e421667b56d8ca492d27b31b33aee32bb0fd6de71627d22872759d1db722977b.
• The sealed metadata is exact-head PASS for PR Fix trusted local audit publication permission #1036.
• Gitar passed and the focused publication, privacy, package-workflow, generated-workflow/actionlint, and diff checks passed.
• This is the one circular bootstrap: the default branch still has the read-only Pull requests permission, so the PR cannot publish its own accepted audit comment through the path it fixes.

Applying the documented current-head owner override. After merge, a new exact-head audit must demonstrate normal trusted publication before v1.5.0 canaries or release publication.