From f12bd75a40ca2065bd2af18ee5df601e0ae6fbd1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Cl=C3=A9ment=20Fiere?= Date: Wed, 12 Aug 2026 00:21:52 +0200 Subject: [PATCH] fix(ci): grant pull-requests write to fork label job (#2542) --- .github/scripts/claude-code-review-workflow-contract_test.py | 1 + .github/workflows/claude-code-review.yml | 4 ++++ 2 files changed, 5 insertions(+) diff --git a/.github/scripts/claude-code-review-workflow-contract_test.py b/.github/scripts/claude-code-review-workflow-contract_test.py index 5186d9b21c..63a7907d23 100644 --- a/.github/scripts/claude-code-review-workflow-contract_test.py +++ b/.github/scripts/claude-code-review-workflow-contract_test.py @@ -155,6 +155,7 @@ class ClaudeCodeReviewWorkflowContractTest(unittest.TestCase): label_job, ) self.assertIn("issues: write", label_job) + self.assertIn("pull-requests: write", label_job) self.assertIn("github.rest.issues.addLabels", label_job) self.assertIn( "const labels = ['safe-to-review', 'safe-to-test'];", diff --git a/.github/workflows/claude-code-review.yml b/.github/workflows/claude-code-review.yml index c545be98e4..3c7e2d35da 100644 --- a/.github/workflows/claude-code-review.yml +++ b/.github/workflows/claude-code-review.yml @@ -86,6 +86,10 @@ jobs: runs-on: ubuntu-latest permissions: issues: write + # issues.addLabels on a *pull request* requires the PR-scoped + # permission; issues: write alone 403s with "Resource not accessible + # by integration" (see kdlbs/kandev#2532 and siblings). + pull-requests: write steps: - name: Add automatic fork approval labels