[bacluc-agent]

What broke

Autorelease failed on projectsyn#6:
run 41829920010 / job 126574135507

HttpError: Resource not accessible by integration
POST /repos/projectsyn/component-solution-backup/issues/6/comments -> 403

Root cause

create-release-tag runs on pull_request. projectsyn/component-solution-backup#6 was opened from this fork, and GitHub always gives pull_request runs from forks a read-only GITHUB_TOKEN with no secrets — visible in the run log:

## GITHUB_TOKEN Permissions
Issues: read
PullRequests: read
Secret source: None

projectsyn/pr-label-tag-action writes through the API (issues.createComment, git.createRef, actions.createWorkflowDispatch), so the first write — the "Merging this PR will release v0.1.1" comment — fails with the 403 above. The permissions: key cannot lift that limit for fork runs, and a PAT secret is not reachable either (no secrets in fork runs).

Same-repo PRs are unaffected, which is why the identical workflow file works in the other component repos: component-solution-backup#1 released v0.1.0 and component-argocd#327 got its release comment.

Fix

Trigger the workflow on pull_request_target instead, which runs the base branch's workflow with a write token even for public forks, and state the permissions the action needs explicitly instead of relying on the repository default. The job never checks out or executes PR code — it only reads the PR metadata from the event payload — so pull_request_target is safe here. The action itself is payload-driven (payload.pull_request, payload.action, pull_request.merged / merge_commit_sha), all of which pull_request_target provides, so no action change is needed.

Single commit 31ef186 on branch fix-autorelease-fork-pr-permissions: .github/workflows/auto-release.yaml (+9/-1).

Notes for upstream

• This PR is against the fork only. To land the fix, fix-autorelease-fork-pr-permissions needs a PR into projectsyn/component-solution-backup:master — see class: fix multi instance behaviour projectsyn/component-solution-backup#6 for the tracking comment. The same latent bug exists in every component repo generated from projectsyn/commodore-component-template ({{ cookiecutter.slug }}/.github/workflows/auto-release.yaml); fixing it there is deliberately out of scope of this PR.
• Runs triggered by contributors without write access now need maintainer approval, because they carry a write token.
• pull_request_target uses the workflow file from the base branch, so nothing changes for existing PRs until this is merged.

Test evidence

See the next comment / https://github.com/bacluc-agent/component-solution-backup/pull/... (in-progress: verifying the release comment, tag creation and Release dispatch on this fork, which is where the fixed workflow actually runs).

[bacluc-agent]

Test evidence, all of it from this fork (same file contents as upstream, plus restricted default workflow permissions, which is the harsher case):

step	run
pull_request_target run, release comment "Merging this PR will release v0.1.2"	41836450028 (PR #6)
comment create / update on label remove+add and on synchronize	41835778246, 41835789086, 41835903932 (PR #3)
tag v0.1.2 created on merge + comment updated to "released"	41836656024
Release workflow dispatched and succeeded (release page created)	41836673050
yamllint / editorconfig / golden tests on both workflow files	41836448376

Two things this PR's variant got wrong and later commits fixed: issues: write is not enough for a PR conversation comment (see #4, run 41834795755), and the dispatched Release workflow needs its own permissions (see #5, run 41836068941).

All three branches here are staging. The upstream-facing change is one commit on autorelease-fork-pr-writes (88da95d, based on current upstream master, both workflow files, net +16/-1) — open the PR into projectsyn/component-solution-backup:master from that branch. Test tags v0.1.1/v0.1.2 and the v0.1.2 release were deleted again; throwaway branches are gone.