From f74fa794c34bc9fc98bdbbd9e0323b324bd7d255 Mon Sep 17 00:00:00 2001
From: ChrisRackauckas <accounts@chrisrackauckas.com>
Date: Tue, 13 Oct 2026 02:00:16 +0200
Subject: [PATCH] Grant TagBot the token permissions its reusable workflow
 requests

This repo's default GITHUB_TOKEN is read-only, so TagBot runs fail with startup_failure when the reusable workflow requests contents: write. Grant the permissions the reusable workflow declares.

Co-Authored-By: Chris Rackauckas <accounts@chrisrackauckas.com>
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Agent-Harness: Devin CLI 3000.11.3
Agent-Model: Fusion (Claude Opus 5.5 Medium + SWE-2 Medium)
Agent-Session: local Devin session ID grizzled-gazelle (not a URL)
---
 .github/workflows/TagBot.yml | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/.github/workflows/TagBot.yml b/.github/workflows/TagBot.yml
index 9ed2d3e..e55aba3 100644
--- a/.github/workflows/TagBot.yml
+++ b/.github/workflows/TagBot.yml
@@ -5,5 +5,19 @@ on:
   workflow_dispatch:
 jobs:
   tagbot:
+    # This repository's default GITHUB_TOKEN is read-only; the reusable workflow needs these to run and to tag.
+    permissions:
+      actions: read
+      checks: read
+      contents: write
+      deployments: read
+      issues: read
+      discussions: read
+      packages: read
+      pages: read
+      pull-requests: read
+      repository-projects: read
+      security-events: read
+      statuses: read
     uses: "SciML/.github/.github/workflows/tagbot.yml@v1"
     secrets: "inherit"