[workflow-patrol] Workflow drift detected: PR review fork example omits required permissions

[github-actions]

Findings

1. pr-review-fork does not grant permissions required by the called workflow

Deviating workflow: gh-agent-workflows/pr-review-fork/example.yml

Evidence: The example declares only contents: read, issues: write, and pull-requests: write at lines 27-30. It then invokes elastic/ai-github-actions/.github/workflows/gh-aw-pr-review.lock.yml@v0 at line 37. The called source requires copilot-requests: write and actions: read at .github/workflows/gh-aw-pr-review.md:79-83.

Majority pattern: Comparable caller examples grant both permissions; for example, gh-agent-workflows/pr-review/example.yml:6-11, gh-agent-workflows/issue-triage/example.yml:6-12, and gh-agent-workflows/bug-hunter/example.yml:7-12. The independent inventory found this pattern in 48 of 49 examples.

Impact: The fork-specific example can fail reusable-workflow permission validation or prevent the called workflow from obtaining its required Copilot request and Actions-read permissions. Consumers copying the template are given a non-working configuration.

Suggested fix: Add actions: read and copilot-requests: write to gh-agent-workflows/pr-review-fork/example.yml, matching the called workflow and peer examples.

Suggested Actions

• Add actions: read to the pr-review-fork example permissions.
• Add copilot-requests: write to the pr-review-fork example permissions.
• Keep the example permissions aligned with gh-aw-pr-review.md.

Generated by Internal: Workflow Patrol · 822.7 AIC · ⌖ 16.6 AIC · ⊞ 23.9K · ◷

• expires on Jul 23, 2026, 2:45 PM UTC

[github-actions]

This issue was automatically closed because it expired on 2026-07-23T14:45:40.794Z.

Closed by Workflow