fix: grant changelog workflow project permissions

Author: coisa

CHANGELOG.md

@@ -7,6 +7,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Fixed
+
+- Grant project-board write permission in the packaged changelog workflow wrapper so consumer release workflows can call the reusable changelog automation without GitHub rejecting the requested permissions (#251)
+
 ## [1.22.0] - 2026-04-24
 
 ### Added

docs/advanced/branch-protection-and-bot-commits.rst

@@ -177,7 +177,10 @@ To enable reusable project automation in consumer repositories, pass
 ``project`` through the thin ``workflow_call`` wrapper or configure the
 repository variable ``PROJECT`` so the workflow can resolve the target GitHub
 Project without hardcoding repository-specific board identifiers into the
-packaged workflow itself. The workflow derives the owner from
+packaged workflow itself. Consumer wrappers that call reusable workflows with
+project-board release transitions MUST also grant ``repository-projects: write``
+at the caller level; otherwise GitHub rejects the workflow before the release
+automation starts. The workflow derives the owner from
 ``github.repository_owner`` and uses the built-in workflow token for the actual
 project mutations. Inside ``php-fast-forward`` repositories, the reusable
 workflow MAY fall back to the first organization Project V2 when no explicit

resources/github-actions/changelog.yml

@@ -31,6 +31,7 @@ on:
 permissions:
   contents: write
   pull-requests: write
+  repository-projects: write
 
 jobs:
   changelog: