From 13db6a35c2b678f95a4039e6106ef005786101c7 Mon Sep 17 00:00:00 2001
From: Copilot <copilot@github.com>
Date: Tue, 4 Aug 2026 11:02:59 +0200
Subject: [PATCH] Restore pull-requests: write so release-note comments can
 post

The check_release_notes workflow (rewritten in #20081) reduced the token
to pull-requests: read. issues.createComment (POST) on a pull request
requires pull-requests: write, so brand-new PRs that have no existing
bot comment -- for example dependency updates opened by dotnet-maestro
(#20134) -- failed with 403 'Resource not accessible by integration'.
Only PRs that already had a comment from before #20081 passed, because
the updateComment (PATCH) path works with issues: write.

The security fix in #20081 was removing the untrusted fork-head
checkout; that protection is unchanged. No untrusted code runs and the
comment body is passed via an environment variable, so restoring
pull-requests: write does not reintroduce the fork-checkout risk.

Also wrap the comment logic in try/catch so posting the informational
comment can never fail the release-notes gate, which is enforced by the
previous step's exit code.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .github/workflows/check_release_notes.yml | 51 +++++++++++++----------
 1 file changed, 29 insertions(+), 22 deletions(-)

diff --git a/.github/workflows/check_release_notes.yml b/.github/workflows/check_release_notes.yml
index 34a19b198c5..cc29e6c9929 100644
--- a/.github/workflows/check_release_notes.yml
+++ b/.github/workflows/check_release_notes.yml
@@ -8,7 +8,7 @@ on:
 permissions:
   contents: read
   issues: write
-  pull-requests: read
+  pull-requests: write
 concurrency:
   group: release-notes-${{ github.event.pull_request.number }}
   cancel-in-progress: true
@@ -17,7 +17,7 @@ jobs:
     permissions:
       contents: read
       issues: write
-      pull-requests: read
+      pull-requests: write
     env:
       GH_TOKEN: ${{ github.token }}
       PR_AUTHOR: ${{ github.event.pull_request.user.login }}
@@ -314,29 +314,36 @@ jobs:
         github-token: ${{ github.token }}
         script: |
             const marker = '<!-- DO_NOT_REMOVE: release_notes_check -->';
-            const comments = await github.paginate(github.rest.issues.listComments, {
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                issue_number: context.issue.number,
-                per_page: 100
-            });
-            const existing = comments.find(comment =>
-                comment.user?.login === 'github-actions[bot]' && comment.body?.includes(marker));
-
-            if (existing) {
-                const comment = await github.rest.issues.updateComment({
+            // Posting the status comment is best-effort and must never fail the check:
+            // the release-notes gate is enforced by the previous step's exit code.
+            try {
+                const comments = await github.paginate(github.rest.issues.listComments, {
+                    owner: context.repo.owner,
+                    repo: context.repo.repo,
+                    issue_number: context.issue.number,
+                    per_page: 100
+                });
+                const existing = comments.find(comment =>
+                    comment.user?.login === 'github-actions[bot]' && comment.body?.includes(marker));
+
+                if (existing) {
+                    const comment = await github.rest.issues.updateComment({
+                        owner: context.repo.owner,
+                        repo: context.repo.repo,
+                        comment_id: existing.id,
+                        body: process.env.COMMENT_BODY
+                    });
+                    return comment.data.id;
+                }
+
+                const comment = await github.rest.issues.createComment({
+                    issue_number: context.issue.number,
                     owner: context.repo.owner,
                     repo: context.repo.repo,
-                    comment_id: existing.id,
                     body: process.env.COMMENT_BODY
                 });
                 return comment.data.id;
+            } catch (error) {
+                core.warning(`Unable to post the release-notes status comment: ${error.message}`);
+                return '';
             }
-
-            const comment = await github.rest.issues.createComment({
-                issue_number: context.issue.number,
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                body: process.env.COMMENT_BODY
-            });
-            return comment.data.id;