From 76a03fac91a18bbac99bef7652dba7292e7d2f07 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Francisco=20Ign=C3=A1cio=20Fontoura=20Solla?= <fsolla@pm.me>
Date: Thu, 30 Jul 2026 13:37:31 -0300
Subject: [PATCH] fix(ci): grant migration-lock pull-requests read on
 GITHUB_TOKEN
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Checkout fixed the missing .git, but `gh pr list` then failed with
"GraphQL: Resource not accessible by integration (repository.pullRequests)"
— the default token needs an explicit permission grant.
---
 .github/workflows/ci-pr.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/workflows/ci-pr.yml b/.github/workflows/ci-pr.yml
index 2dcc477a..239b750c 100644
--- a/.github/workflows/ci-pr.yml
+++ b/.github/workflows/ci-pr.yml
@@ -87,6 +87,10 @@ jobs:
     # chain; the second PR must wait or rebase.
     runs-on: ubuntu-latest
     timeout-minutes: 5
+    permissions:
+      # gh pr list against the default GITHUB_TOKEN.
+      contents: read
+      pull-requests: read
     steps:
       # gh expands --json files via git, so it needs the repo checked out.
       - uses: actions/checkout@v4