[Tomlu60220244]

Fixes #8592

What changes did you make?

Added explicit workflow-level permissions to the PR label workflows.

For .github/workflows/set-pr-labels.yaml:

• contents: read
• issues: read

For .github/workflows/wr-set-pr-labels.yaml:

• contents: read
• actions: read
• issues: write
• pull-requests: write

Why did you make the changes?

This limits the default GITHUB_TOKEN permissions to the minimum required access for these workflows, following GitHub Actions security best practices.

pull-requests: write is included only in .github/workflows/wr-set-pr-labels.yaml because testing confirmed that this workflow needs write access to pull requests. It was removed from .github/workflows/set-pr-labels.yaml because that workflow does not write to pull requests.

CodeQL Alerts

• I have checked this PR for CodeQL alerts and none were found.
• I found CodeQL alert(s), and resolved or documented them.

Screenshots of Proposed Changes To The Website

No visual changes to the website.

Testing

Testing confirmed that pull-requests: write is required for .github/workflows/wr-set-pr-labels.yaml, but it is not needed for .github/workflows/set-pr-labels.yaml.

With these permissions, each workflow has the minimum permissions needed for its behavior.

[github-actions]

Want to review this pull request? Take a look at this documentation for a step by step guide!

---

From your project repository, check out a new branch and test the changes.

git checkout -b Tomlu60220244-8592-test-pull-requests-write gh-pages
git pull https://github.com/Tomlu60220244/website.git 8592-test-pull-requests-write

[t-will-gillis]

Hey @Tomlu60220244 - Thanks for working on this! We already discussed the reason to add the pull-requests: write permission to wr-set-pr-labels.yaml in #8592. Great catch on this!

The only comments I have are:

• please confirm that the pull-requests: write permission is needed on set-pr-labels.yaml. Since the workflow is not writing to the PR in this step it should not be needed. I tested the workflow in my repo, and unless you are seeing something different from me I don't believe this is needed.
• very minor thing, but please check the Action Item boxes in the original issue.

Great job again!

[Tomlu60220244]

Thanks @t-will-gillis for checking this.

I’ll remove pull-requests: write from .github/workflows/set-pr-labels.yaml since that workflow does not write to the PR. I’ll keep pull-requests: write in .github/workflows/wr-set-pr-labels.yaml, where it is needed.

[t-will-gillis]

Hey @Tomlu60220244 would you please finish this PR? if you are no longer working on it, let us know so that we can re-assign it. Thanks

[Tomlu60220244]

@t-will-gillis Sorry for the delay. I had acknowledged your feedback earlier and intended to remove the unnecessary pull-requests: write permission from set-pr-labels.yaml, but I realized I never pushed that final follow-up change.

I have now removed it. set-pr-labels.yaml only has contents: read and issues: read, while wr-set-pr-labels.yaml keeps pull-requests: write because that workflow needs it.

I also confirmed that the Action Item boxes in #8592 are checked. Thanks for the reminder, and sorry for leaving this PR unfinished.

[Tomlu60220244]

@t-will-gillis Sorry for the delay. I had already seen your feedback, but I realized I never pushed the final change.

I removed pull-requests: write from set-pr-labels.yaml and kept it only in wr-set-pr-labels.yaml.

Thanks for the reminder!

[t-will-gillis]

Perfect- thanks @Tomlu60220244