From 14f9f3f350c9d24e69f187102d58d64c2e5f2c81 Mon Sep 17 00:00:00 2001 From: "Dina Berry (She/her)" Date: Sat, 4 Apr 2026 10:18:38 -0700 Subject: [PATCH] fix(ci): change impact workflow permission from issues:write to pull-requests:write The impact analysis posts PR comments via the Issues API, which accepts either issues:write or pull-requests:write. Using pull-requests:write is least-privilege since this workflow only operates on PRs. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .github/workflows/squad-impact.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/.github/workflows/squad-impact.yml b/.github/workflows/squad-impact.yml index 75811695c..f7fd7c59a 100644 --- a/.github/workflows/squad-impact.yml +++ b/.github/workflows/squad-impact.yml @@ -10,8 +10,7 @@ on: # PR data is fetched read-only via gh CLI — no untrusted code is executed. permissions: contents: read - pull-requests: read - issues: write + pull-requests: write concurrency: group: ${{ github.workflow }}-${{ github.event.pull_request.number }}