From 041d6f520304fe65ac094a70aab08c611c87d743 Mon Sep 17 00:00:00 2001
From: Copilot <223556219+Copilot@users.noreply.github.com>
Date: Tue, 4 Aug 2026 14:03:31 +0200
Subject: [PATCH 1/2] Restore write permission for release-notes check comment

Posting the bot comment needs pull-requests: write; the token was reduced to read, so createComment failed with 'Resource not accessible by integration' and turned check_release_notes red even when no release notes were required. Restored the write scope and made the comment best-effort so the check reflects the release-notes verdict, not the comment API result.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .github/workflows/check_release_notes.yml | 51 +++++++++++++----------
 1 file changed, 29 insertions(+), 22 deletions(-)

diff --git a/.github/workflows/check_release_notes.yml b/.github/workflows/check_release_notes.yml
index 34a19b198c5..9273bd263cd 100644
--- a/.github/workflows/check_release_notes.yml
+++ b/.github/workflows/check_release_notes.yml
@@ -8,7 +8,7 @@ on:
 permissions:
   contents: read
   issues: write
-  pull-requests: read
+  pull-requests: write
 concurrency:
   group: release-notes-${{ github.event.pull_request.number }}
   cancel-in-progress: true
@@ -17,7 +17,7 @@ jobs:
     permissions:
       contents: read
       issues: write
-      pull-requests: read
+      pull-requests: write
     env:
       GH_TOKEN: ${{ github.token }}
       PR_AUTHOR: ${{ github.event.pull_request.user.login }}
@@ -314,29 +314,36 @@ jobs:
         github-token: ${{ github.token }}
         script: |
             const marker = '<!-- DO_NOT_REMOVE: release_notes_check -->';
-            const comments = await github.paginate(github.rest.issues.listComments, {
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                issue_number: context.issue.number,
-                per_page: 100
-            });
-            const existing = comments.find(comment =>
-                comment.user?.login === 'github-actions[bot]' && comment.body?.includes(marker));
-
-            if (existing) {
-                const comment = await github.rest.issues.updateComment({
+            try {
+                const comments = await github.paginate(github.rest.issues.listComments, {
+                    owner: context.repo.owner,
+                    repo: context.repo.repo,
+                    issue_number: context.issue.number,
+                    per_page: 100
+                });
+                const existing = comments.find(comment =>
+                    comment.user?.login === 'github-actions[bot]' && comment.body?.includes(marker));
+
+                if (existing) {
+                    const comment = await github.rest.issues.updateComment({
+                        owner: context.repo.owner,
+                        repo: context.repo.repo,
+                        comment_id: existing.id,
+                        body: process.env.COMMENT_BODY
+                    });
+                    return comment.data.id;
+                }
+
+                const comment = await github.rest.issues.createComment({
+                    issue_number: context.issue.number,
                     owner: context.repo.owner,
                     repo: context.repo.repo,
-                    comment_id: existing.id,
                     body: process.env.COMMENT_BODY
                 });
                 return comment.data.id;
+            } catch (error) {
+                // The comment is informational only. The release-notes verdict is enforced by the
+                // "Check for release notes changes" step, so never fail the job if posting fails
+                // (e.g. a read-only token on some pull requests).
+                core.warning(`Unable to post release-notes comment: ${error.message}`);
             }
-
-            const comment = await github.rest.issues.createComment({
-                issue_number: context.issue.number,
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                body: process.env.COMMENT_BODY
-            });
-            return comment.data.id;

From 015266b998604e72b6d37867785448e5cfbe9ff4 Mon Sep 17 00:00:00 2001
From: Copilot <223556219+Copilot@users.noreply.github.com>
Date: Tue, 4 Aug 2026 15:40:04 +0200
Subject: [PATCH 2/2] Never fail release-notes check when posting its comment
 fails

The comment is informational only; the verdict is enforced by the shell step. Mark the comment step continue-on-error so an API or action-level failure (e.g. a read-only token) can never turn the check red.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .github/workflows/check_release_notes.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/check_release_notes.yml b/.github/workflows/check_release_notes.yml
index 9273bd263cd..7284f35d4c0 100644
--- a/.github/workflows/check_release_notes.yml
+++ b/.github/workflows/check_release_notes.yml
@@ -307,6 +307,8 @@ jobs:
     # Keep one bot comment current without evaluating pull request content as JavaScript.
     - name: Create or update comment
       if: ${{ (success() || failure()) && steps.release_notes_changes.outputs.release-notes-check-message != '' }}
+      # The comment is informational; never let posting it fail the release-notes verdict.
+      continue-on-error: true
       uses: actions/github-script@v9
       env:
         COMMENT_BODY: ${{ steps.release_notes_changes.outputs.release-notes-check-message }}