From 238de37fe348284709156be2a8a73f32bf7ba931 Mon Sep 17 00:00:00 2001 From: Jan-Kazlouski-elastic Date: Tue, 4 Aug 2026 10:48:51 +0300 Subject: [PATCH 1/3] fix(ci): grant explicit GITHUB_TOKEN permissions to workflows The repository default for GITHUB_TOKEN is now read-only, and neither workflow declared a permissions block, so backport started failing with push denied to github-actions[bot] and "Resource not accessible by integration" when commenting on the source PR. Declare the scopes each workflow actually needs, which overrides the read-only default without re-granting write to everything. Part of https://github.com/elastic/crawler/issues/465 Co-authored-by: Cursor --- .github/workflows/add-labels-main.yml | 6 ++++++ .github/workflows/backport.yml | 8 ++++++++ 2 files changed, 14 insertions(+) diff --git a/.github/workflows/add-labels-main.yml b/.github/workflows/add-labels-main.yml index 27c47a76..4444990a 100644 --- a/.github/workflows/add-labels-main.yml +++ b/.github/workflows/add-labels-main.yml @@ -7,6 +7,12 @@ on: types: - opened +# The repository default is read-only, so the scopes this job needs must be +# granted here: checkout reads product_version; the action labels the PR. +permissions: + contents: read + pull-requests: write + jobs: add_labels: runs-on: ubuntu-latest diff --git a/.github/workflows/backport.yml b/.github/workflows/backport.yml index 21b06b92..0ad48837 100644 --- a/.github/workflows/backport.yml +++ b/.github/workflows/backport.yml @@ -8,6 +8,14 @@ on: - labeled - closed +# The repository default is read-only, so the scopes this job needs must be +# granted here: the backport action pushes cherry-pick branches, opens the +# backport PRs, and comments the result back on the source PR. Approving the +# backport PRs uses REPO_SCOPED_TOKEN, not GITHUB_TOKEN. +permissions: + contents: write + pull-requests: write + jobs: backport: if: | From ab53227dc0a4bf45973cafadac1bb1a4a21b75d1 Mon Sep 17 00:00:00 2001 From: Jan-Kazlouski-elastic Date: Tue, 4 Aug 2026 10:50:29 +0300 Subject: [PATCH 2/3] fix(ci): shorten workflow permissions comments Co-authored-by: Cursor --- .github/workflows/backport.yml | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/.github/workflows/backport.yml b/.github/workflows/backport.yml index 0ad48837..37a287cb 100644 --- a/.github/workflows/backport.yml +++ b/.github/workflows/backport.yml @@ -8,10 +8,7 @@ on: - labeled - closed -# The repository default is read-only, so the scopes this job needs must be -# granted here: the backport action pushes cherry-pick branches, opens the -# backport PRs, and comments the result back on the source PR. Approving the -# backport PRs uses REPO_SCOPED_TOKEN, not GITHUB_TOKEN. +# Override read-only GITHUB_TOKEN default: push backport branches and comment on PRs. permissions: contents: write pull-requests: write From e1a61a10bf66ce207d31c46360ae209c17a4db37 Mon Sep 17 00:00:00 2001 From: Jan-Kazlouski-elastic Date: Tue, 4 Aug 2026 10:50:46 +0300 Subject: [PATCH 3/3] fix(ci): shorten add-labels permissions comment Co-authored-by: Cursor --- .github/workflows/add-labels-main.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/.github/workflows/add-labels-main.yml b/.github/workflows/add-labels-main.yml index 4444990a..c5e7dbc8 100644 --- a/.github/workflows/add-labels-main.yml +++ b/.github/workflows/add-labels-main.yml @@ -7,8 +7,7 @@ on: types: - opened -# The repository default is read-only, so the scopes this job needs must be -# granted here: checkout reads product_version; the action labels the PR. +# Override read-only GITHUB_TOKEN default: label newly opened PRs. permissions: contents: read pull-requests: write