Request PR read access for no-fallback branch pushes

[Copilot]

push-to-pull-request-branch reads PR metadata before pushing. With fallback disabled, generated GitHub App tokens omitted pull-request access, causing the lookup to fail with 403.

• Permission generation

  • Request pull-requests: read with contents: write when fallback-as-pull-request: false.
  • Preserve pull-requests: write when fallback remains enabled.

• Regression coverage

  • Assert computed permissions and compiled workflow output include read-only PR access without PR write access.

permission-contents: write
permission-pull-requests: read

• Fixes push-to-pull-request-branch omits PR read permission when fallback is disabled #59512

[Copilot]

🔵 Needs a closer look

The regression test assertion is currently too broad to guarantee the GitHub App token requests permission-pull-requests: read, and the large lockfile/model-list churn appears out of scope for the stated fix and should be clarified or reverted.

Pull request overview

This PR fixes a permissions regression in the push-to-pull-request-branch safe-output handler by ensuring the generated GitHub App token can read Pull Request metadata even when fallback PR creation is disabled.

Changes:

• Add pull-requests: read to the computed permissions when fallback-as-pull-request: false.
• Update Go unit tests to assert the new permission behavior.
• Regenerate multiple workflow lockfiles (includes unrelated embedded firewall model allowlist updates).

File summaries

File	Description
pkg/workflow/safe_output_handlers.go	Adds pull-requests: read when PR fallback is disabled.
pkg/workflow/safe_outputs_permissions_test.go	Updates expected computed permissions for the fallback-disabled case.
pkg/workflow/push_to_pull_request_branch_test.go	Adds/adjusts compilation-based regression assertions for PR permissions.
.github/workflows/windows.lock.yml	Regenerated lockfile; embedded firewall config blob changed (model allowlist).
.github/workflows/windows-grower.lock.yml	Regenerated lockfile; embedded firewall config blob changed (model allowlist).
.github/workflows/semantic-function-refactor.lock.yml	Regenerated lockfile; embedded firewall config blob changed (model allowlist).
.github/workflows/notion-issue-summary.lock.yml	Regenerated lockfile; embedded firewall config blob changed (model allowlist).
.github/workflows/hippo-embed.lock.yml	Regenerated lockfile; embedded firewall config blob changed (model allowlist).
.github/workflows/firewall.lock.yml	Regenerated lockfile; embedded firewall config blob changed (model allowlist).
.github/workflows/example-permissions-warning.lock.yml	Regenerated lockfile; embedded firewall config blob changed (model allowlist).
.github/workflows/daily-max-ai-credits-test.lock.yml	Regenerated lockfile; embedded firewall config blob changed (model allowlist).
.github/workflows/daily-harness-experiment-proposer.lock.yml	Regenerated lockfile; embedded firewall config blob changed (model allowlist).
.github/workflows/daily-credit-limit-test.lock.yml	Regenerated lockfile; embedded firewall config blob changed (model allowlist).
.github/workflows/codex-github-remote-mcp-test.lock.yml	Regenerated lockfile; embedded firewall config blob changed (model allowlist).
.github/workflows/agentic-token-optimizer.lock.yml	Regenerated lockfile; embedded firewall config blob changed (model allowlist).

Review details

• Files reviewed: 30/301 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

[gh-aw-bot]

@copilot this PR is merge-conflicting and still has failing checks.

Please run make merge-main to resolve the conflict, then re-run the focused fix for the PR-read-permission regression. After that, run the pr-finisher skill.

Current failing checks:

• impacted-go-tests: https://github.com/github/gh-aw/actions/runs/34360256550/job/102501596281
• build-wasm: https://github.com/github/gh-aw/actions/runs/34360256550/job/102501596230
• Unit tests (D-G): https://github.com/github/gh-aw/actions/runs/34360256550/job/102502176569
• Unit tests (S-Z and other): https://github.com/github/gh-aw/actions/runs/34360256550/job/102502176592

Run: https://github.com/github/gh-aw/actions/runs/34363077615

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• github.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "github.com"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 20.6 AIC · ⌖ 7.13 AIC · ⊞ 9.3K · ◷
_{Comment /souschef to run again}

[Copilot]

@copilot this PR is merge-conflicting and still has failing checks.

Please run make merge-main to resolve the conflict, then re-run the focused fix for the PR-read-permission regression. After that...

Resolved the main conflict and restored the unrelated generated lockfiles to main; the focused regression assertion is narrowed in 838673ce. Local lint, test, recompilation, and final validation pass.