From 582180a9c0263136eb67d7ec601084e2af5fd490 Mon Sep 17 00:00:00 2001 From: Landon Cox Date: Sat, 18 Jul 2026 08:47:31 -0700 Subject: [PATCH] fix(smoke-copilot): revert agent job to read-only perms MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit PR #6366 changed the smoke-copilot agent job to issues:write / pull-requests:write, but the gh-aw compiler (v0.82.13) forbids write permissions on the agent job — writes must flow through safe-outputs' scoped app token. As a result the lock file's frontmatter_hash could not be regenerated and stayed at the read-perm value (008d5a5c), while the .md advertised write perms. This mismatch made the 'Check workflow lock file' activation step fail on every open PR (CI builds the branch merged with main), e.g. #6362, even for PRs that never touched smoke-copilot. Revert issues/pull-requests to read (safe-outputs already handles the comment/label writes) and recompile so .md and lock are consistent. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 23717692-af7a-4e03-a156-5b696c3f01bd --- .github/workflows/smoke-copilot.lock.yml | 4 ++-- .github/workflows/smoke-copilot.md | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/smoke-copilot.lock.yml b/.github/workflows/smoke-copilot.lock.yml index cf9b5cbc5..312dd1e2b 100644 --- a/.github/workflows/smoke-copilot.lock.yml +++ b/.github/workflows/smoke-copilot.lock.yml @@ -444,8 +444,8 @@ jobs: actions: read contents: read copilot-requests: write - issues: write - pull-requests: write + issues: read + pull-requests: read env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} GH_AW_ASSETS_ALLOWED_EXTS: "" diff --git a/.github/workflows/smoke-copilot.md b/.github/workflows/smoke-copilot.md index 48ab1219e..d44bc739e 100644 --- a/.github/workflows/smoke-copilot.md +++ b/.github/workflows/smoke-copilot.md @@ -11,8 +11,8 @@ on: reaction: "eyes" permissions: contents: read - pull-requests: write - issues: write + pull-requests: read + issues: read actions: read copilot-requests: write name: Smoke Copilot