From d77a23ea2e6a9796391b44b37bbe9208758fdab3 Mon Sep 17 00:00:00 2001 From: Jeff Huber Date: Fri, 18 Sep 2026 02:42:48 -0700 Subject: [PATCH] Fix local audit publication comment permission --- .github/workflows/local-audit-publication.yml | 2 +- .../templates/workflows/local-audit-publication.yml.j2 | 2 +- templates/workflows/local-audit-publication.yml.j2 | 2 +- tests/test_audit_publication.py | 5 +++++ 4 files changed, 8 insertions(+), 3 deletions(-) diff --git a/.github/workflows/local-audit-publication.yml b/.github/workflows/local-audit-publication.yml index 80958dcd..65ab4d40 100644 --- a/.github/workflows/local-audit-publication.yml +++ b/.github/workflows/local-audit-publication.yml @@ -7,7 +7,7 @@ on: permissions: contents: read actions: read - pull-requests: read + pull-requests: write issues: write concurrency: group: code-mower-local-audit-publication diff --git a/src/code_mower/templates/workflows/local-audit-publication.yml.j2 b/src/code_mower/templates/workflows/local-audit-publication.yml.j2 index 80958dcd..65ab4d40 100644 --- a/src/code_mower/templates/workflows/local-audit-publication.yml.j2 +++ b/src/code_mower/templates/workflows/local-audit-publication.yml.j2 @@ -7,7 +7,7 @@ on: permissions: contents: read actions: read - pull-requests: read + pull-requests: write issues: write concurrency: group: code-mower-local-audit-publication diff --git a/templates/workflows/local-audit-publication.yml.j2 b/templates/workflows/local-audit-publication.yml.j2 index 80958dcd..65ab4d40 100644 --- a/templates/workflows/local-audit-publication.yml.j2 +++ b/templates/workflows/local-audit-publication.yml.j2 @@ -7,7 +7,7 @@ on: permissions: contents: read actions: read - pull-requests: read + pull-requests: write issues: write concurrency: group: code-mower-local-audit-publication diff --git a/tests/test_audit_publication.py b/tests/test_audit_publication.py index 17409c5d..166f8e79 100644 --- a/tests/test_audit_publication.py +++ b/tests/test_audit_publication.py @@ -737,6 +737,11 @@ def test_workflow_has_no_unvalidated_output_or_pr_execution(self): self.assertIn("ref: ${{ github.sha }}", text) self.assertIn("python3 tools/audit_publication.py publish", text) self.assertIn("cancel-in-progress: false", text) + # A pull request uses the Issues comments endpoint, but GitHub's + # installation token authorizes that resource through Pull requests. + # Read-only permission fails at the reservation-comment write with 403. + self.assertIn("pull-requests: write", text) + self.assertIn("issues: write", text) for name in ( "local-audit-publication.yml.j2", "trailer-comment-labeler.yml.j2",