Skip to content

fix: add missing issues:write permission for PR autolabeler#20

Merged
shenxianpeng merged 1 commit into
mainfrom
fix/labeler-missing-issues-permission
Jul 6, 2026
Merged

fix: add missing issues:write permission for PR autolabeler#20
shenxianpeng merged 1 commit into
mainfrom
fix/labeler-missing-issues-permission

Conversation

@shenxianpeng

Copy link
Copy Markdown
Member

Problem

Since the refactoring to use a reusable workflow from commit-check/.github (commit 6e3b539), every pull_request event fails with startup_failure on the labeler workflow (PRs #17, #18, #19, etc.).

Root Cause

The caller workflow (labeler.yml) sets:

  • permissions: {} at the top level → all permissions default to none
  • permissions: { pull-requests: write, contents: read } at the job level → issues stays at none

But the reusable workflow (commit-check/.github/.github/workflows/pr-labeler.yml) requests issues: write because the release-drafter/autolabeler uses the Issues API to set PR labels.

When a reusable workflow requests permissions that exceed what the caller grants, GitHub Actions rejects the run at startup (startup_failure).

The release-drafter.yml works fine because its reusable workflow only requests contents: write + pull-requests: write — no issues: write.

Fix

Add issues: write to the job-level permissions in labeler.yml so the reusable workflow receives a GITHUB_TOKEN with sufficient scope.

Verification

Run a pull_request event on this branch to confirm the autolabeler starts correctly.

The reusable workflow (commit-check/.github/.github/workflows/pr-labeler.yml)
requires 'issues: write' permission because the release-drafter autolabeler
uses the Issues API to set labels on PRs.

When a caller invokes a reusable workflow with 'permissions: {}' at the top
level and only 'pull-requests: write' + 'contents: read' at the job level,
'issues' defaults to 'none'. The reusable workflow cannot escalate its
permissions beyond what the caller grants, causing a startup_failure.

This adds 'issues: write' to the caller job-level permissions so the
reusable workflow's GITHUB_TOKEN can create PR labels.
@coderabbitai

coderabbitai Bot commented Jul 6, 2026

Copy link
Copy Markdown

Warning

Review limit reached

@shenxianpeng, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 20 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 98f5377d-2131-4930-9e72-fcef6f3746d9

📥 Commits

Reviewing files that changed from the base of the PR and between 069f7f3 and 2db6fa5.

📒 Files selected for processing (1)
  • .github/workflows/labeler.yml
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch fix/labeler-missing-issues-permission

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@github-actions github-actions Bot added the bug Something isn't working label Jul 6, 2026
@codecov-commenter

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (069f7f3) to head (2db6fa5).

Additional details and impacted files
@@            Coverage Diff            @@
##              main       #20   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files            2         2           
  Lines          209       209           
=========================================
  Hits           209       209           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@shenxianpeng shenxianpeng merged commit 24ca2df into main Jul 6, 2026
7 checks passed
@shenxianpeng shenxianpeng deleted the fix/labeler-missing-issues-permission branch July 6, 2026 19:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't working

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants