From 695dd6d5ddce5c928a08b2c7705143378bbb6cf4 Mon Sep 17 00:00:00 2001
From: James Helferty <jhelferty@nvidia.com>
Date: Wed, 2 Sep 2026 16:37:25 -0400
Subject: [PATCH] Grant PR board-sync callers issues and pull-requests write.

Repo-scoped writes in shader-slang/slang's reusable workflow now use
github-actions[bot] via GITHUB_TOKEN, so slangpy callers must pass those
permissions through rather than inheriting an empty grant.
---
 .github/workflows/pr-checks-complete.yml   | 5 +++++
 .github/workflows/pr-commit-status.yml     | 5 +++++
 .github/workflows/pr-maintenance.yml       | 5 +++++
 .github/workflows/pr-review-fork-apply.yml | 5 +++++
 .github/workflows/pr-sweep-nightly.yml     | 5 +++++
 5 files changed, 25 insertions(+)

diff --git a/.github/workflows/pr-checks-complete.yml b/.github/workflows/pr-checks-complete.yml
index c383c97d5..778ca156c 100644
--- a/.github/workflows/pr-checks-complete.yml
+++ b/.github/workflows/pr-checks-complete.yml
@@ -41,6 +41,11 @@ permissions: {}
 
 jobs:
   board-sync:
+    # Repo-scoped writes (assignees, review requests, comments) use
+    # github-actions[bot]; org-team reads and ProjectsV2 writes still use the PAT.
+    permissions:
+      issues: write
+      pull-requests: write
     uses: shader-slang/slang/.github/workflows/pr-board-sync.yml@master
     secrets:
       SLANG_PR_BOT_TOKEN: ${{ secrets.SLANG_PR_BOT_TOKEN }}
diff --git a/.github/workflows/pr-commit-status.yml b/.github/workflows/pr-commit-status.yml
index f6c45aaba..2fb8d4164 100644
--- a/.github/workflows/pr-commit-status.yml
+++ b/.github/workflows/pr-commit-status.yml
@@ -25,6 +25,11 @@ jobs:
     # (success -> recovery, failure/error -> Snagged) changes the outcome, and the
     # recompute is idempotent regardless.
     if: ${{ github.event.state != 'pending' }}
+    # Repo-scoped writes (assignees, review requests, comments) use
+    # github-actions[bot]; org-team reads and ProjectsV2 writes still use the PAT.
+    permissions:
+      issues: write
+      pull-requests: write
     uses: shader-slang/slang/.github/workflows/pr-board-sync.yml@master
     secrets:
       SLANG_PR_BOT_TOKEN: ${{ secrets.SLANG_PR_BOT_TOKEN }}
diff --git a/.github/workflows/pr-maintenance.yml b/.github/workflows/pr-maintenance.yml
index 35a8f4550..112ebf4c2 100644
--- a/.github/workflows/pr-maintenance.yml
+++ b/.github/workflows/pr-maintenance.yml
@@ -52,6 +52,11 @@ jobs:
     if: >-
       github.event_name != 'pull_request_review' ||
       github.event.pull_request.head.repo.fork == false
+    # Repo-scoped writes (assignees, review requests, comments) use
+    # github-actions[bot]; org-team reads and ProjectsV2 writes still use the PAT.
+    permissions:
+      issues: write
+      pull-requests: write
     uses: shader-slang/slang/.github/workflows/pr-board-sync.yml@master
     secrets:
       SLANG_PR_BOT_TOKEN: ${{ secrets.SLANG_PR_BOT_TOKEN }}
diff --git a/.github/workflows/pr-review-fork-apply.yml b/.github/workflows/pr-review-fork-apply.yml
index dae9aa2a8..57533f56c 100644
--- a/.github/workflows/pr-review-fork-apply.yml
+++ b/.github/workflows/pr-review-fork-apply.yml
@@ -25,6 +25,11 @@ jobs:
     # Only when the bridge completed successfully (it always should; this guards
     # against a cancelled/failed relay run).
     if: ${{ github.event.workflow_run.conclusion == 'success' }}
+    # Repo-scoped writes (assignees, review requests, comments) use
+    # github-actions[bot]; org-team reads and ProjectsV2 writes still use the PAT.
+    permissions:
+      issues: write
+      pull-requests: write
     uses: shader-slang/slang/.github/workflows/pr-board-sync.yml@master
     secrets:
       SLANG_PR_BOT_TOKEN: ${{ secrets.SLANG_PR_BOT_TOKEN }}
diff --git a/.github/workflows/pr-sweep-nightly.yml b/.github/workflows/pr-sweep-nightly.yml
index 20fc7c17b..99a37a45e 100644
--- a/.github/workflows/pr-sweep-nightly.yml
+++ b/.github/workflows/pr-sweep-nightly.yml
@@ -24,6 +24,11 @@ permissions: {}
 
 jobs:
   board-sweep:
+    # Repo-scoped writes (assignees, review requests, comments) use
+    # github-actions[bot]; org-team reads and ProjectsV2 writes still use the PAT.
+    permissions:
+      issues: write
+      pull-requests: write
     uses: shader-slang/slang/.github/workflows/pr-board-sync.yml@master
     with:
       mode: sweep