From d515da6aa6ceb522d37a46cb561c38a2326c2988 Mon Sep 17 00:00:00 2001
From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com>
Date: Thu, 8 Oct 2026 18:55:27 -0400
Subject: [PATCH] fix(managed-files-guard): grant pull-requests read to
 check-managed-files callers

From ci-workflows v0.39.0 the check-managed-files action lists the pull
request's commits to skip Dependabot-only pull requests, which needs
pull-requests: read. Both caller templates granted only contents: read,
so every sync pull request failed with a 403 on the commits listing.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01T7GukBojtE99rLCPY7Cw3R
---
 components/managed-files-guard/README.md                   | 7 +++++--
 .../managed-files-guard/managed-files-guard-fleet.yml      | 1 +
 components/managed-files-guard/managed-files-guard.test.sh | 2 +-
 components/managed-files-guard/managed-files-guard.yml     | 1 +
 4 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/components/managed-files-guard/README.md b/components/managed-files-guard/README.md
index 3e0db8a6..06d528a8 100644
--- a/components/managed-files-guard/README.md
+++ b/components/managed-files-guard/README.md
@@ -228,7 +228,9 @@ Two properties of that ride are deliberate:
 - **Failure behavior:** the action fails closed on an unreadable diff or an
   unresolvable manifest, no-ops when the repository is not a manifest target,
   and needs only `contents: read` (standards is public; the checkout of it
-  uses the job's ambient token with `persist-credentials: false`).
+  uses the job's ambient token with `persist-credentials: false`) and
+  `pull-requests: read` (the action lists the pull request's commits to
+  skip pull requests whose every commit is Dependabot's).
 - **The `actions/checkout` pin.** Unlike the Claude lane callers, this file
   carries a third-party action pin, and two consequences follow. In this
   repository, Dependabot's `github-actions` ecosystem scans
@@ -252,7 +254,8 @@ Two properties of that ride are deliberate:
 `managed-files-guard.test.sh` asserts, against the parsed YAML of each file:
 the `pull_request` trigger with the default `types` and a `paths` list equal
 to the managed union of the targets that receive that file, free of glob
-metacharacters; `contents: read` as the whole grant; the
+metacharacters; `contents: read` and `pull-requests: read` as the whole
+grant; the
 canonical `concurrency-policy` block and nothing else in it; one job on its
 literal label with a 10-minute timeout, calling no reusable workflow; a
 full-history, credential-free checkout pinned like the sibling workflows; the
diff --git a/components/managed-files-guard/managed-files-guard-fleet.yml b/components/managed-files-guard/managed-files-guard-fleet.yml
index 44e60000..aa6bcb45 100644
--- a/components/managed-files-guard/managed-files-guard-fleet.yml
+++ b/components/managed-files-guard/managed-files-guard-fleet.yml
@@ -89,6 +89,7 @@ on:
 
 permissions:
   contents: read
+  pull-requests: read
 
 # Canonical block from the standards `concurrency-policy` component: a newer
 # push to the same pull request cancels the in-flight guard run; the
diff --git a/components/managed-files-guard/managed-files-guard.test.sh b/components/managed-files-guard/managed-files-guard.test.sh
index 7ce57977..e38b0d4a 100755
--- a/components/managed-files-guard/managed-files-guard.test.sh
+++ b/components/managed-files-guard/managed-files-guard.test.sh
@@ -103,7 +103,7 @@ check_shape() {
     "$(managed_union "$destination")" "$(q '.on.pull_request.paths[]')"
   assert_silent "$p no paths entry carries a glob metacharacter" \
     "$(q '.on.pull_request.paths[]' | grep -E '[][*?+!]' || true)"
-  assert_eq "$p workflow token is contents: read and nothing else" 'contents=read' \
+  assert_eq "$p workflow token is contents: read and pull-requests: read and nothing else" 'contents=read,pull-requests=read' \
     "$(q '.permissions | to_entries | map(.key + "=" + .value) | join(",")')"
 
   assert_eq "$p concurrency group is the canonical concurrency-policy expression" \
diff --git a/components/managed-files-guard/managed-files-guard.yml b/components/managed-files-guard/managed-files-guard.yml
index f37cfb74..8675d982 100644
--- a/components/managed-files-guard/managed-files-guard.yml
+++ b/components/managed-files-guard/managed-files-guard.yml
@@ -73,6 +73,7 @@ on:
 
 permissions:
   contents: read
+  pull-requests: read
 
 # Canonical block from the standards `concurrency-policy` component: a newer
 # push to the same pull request cancels the in-flight guard run; the