From ee57c6eb2dd407af89ca48e5214fe820f61f9d4b Mon Sep 17 00:00:00 2001
From: Rob Aiken <6567647+robaiken@users.noreply.github.com>
Date: Fri, 30 Oct 2026 12:35:52 +0000
Subject: [PATCH] Grant pull-requests: write to the issue labeler workflow

The labeler runs on pull_request_target, but the GITHUB_TOKEN only had
issues: write. Adding a label to a pull request with that token returns
403 "Resource not accessible by integration", which github/issue-labeler
surfaces only as a bare AggregateError. The workflow has failed on every
allowlist PR since it was added in #311.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 55098ea5-f0c8-4d32-abd9-63f14567c426
---
 .github/workflows/issue-labeler.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/issue-labeler.yml b/.github/workflows/issue-labeler.yml
index aaaecf4..5a1bd23 100644
--- a/.github/workflows/issue-labeler.yml
+++ b/.github/workflows/issue-labeler.yml
@@ -5,6 +5,7 @@ on: # yamllint disable-line rule:truthy
 
 permissions:
   issues: write
+  pull-requests: write
   contents: read
 
 jobs: