action fails unless actions have write permissions

[whitney]

Summary

Our org recently upgraded to Github enterprise and found that workflows using this action would fail with a message "Resource not accessible by integration"

Version

1.3.0

Description

The gh-find-current-pr action fails when granted read-only access at the Enterprise > policies > actions level. It succeeds when we grant read/write access to Github actions. I cannot think of why this action would need write access.

[comp615]

Ran into this too, it looks like all this script does is call listPullRequestsAssociatedWithCommit so perhaps the permissions on that (via octokit) are wonky?

[random-donuts]

just tested, you do not need write, you only need to elevate the permission for pull-requests: read. The default read in the github action pages only set read for content and packages. The rest are all set as none.

This is what I used for my permission

permissions:
  actions: read
  attestations: none
  checks: read
  contents: read
  deployments: read
  id-token: none
  issues: read
  packages: none
  pages: none
  pull-requests: read
  repository-projects: none
  security-events: none
  statuses: none