Add minimum permissions to usage example

[jablko]

This is a change to the docs, only. Does it make sense to add pull-requests: read permissions to this README example, now that restricted permissions is the default for new personal repositories?

By default, when you create a new repository in your personal account, GITHUB_TOKEN only has read access for the contents and packages scopes. If you create a new repository in an organization, the setting is inherited from what is configured in the organization settings.

I just added this action to a new repository, following the example in the README, and was surprised by an opaque access error: Error: Api Error: (403) Resource not accessible by integration

I think this action requires pull-requests: read permissions, at a minimum, to list the commits on a pull request:

fetch-metadata/src/dependabot/verified_commits.ts

Line 32 in e8685ee

const { data: commits } = await client.rest.pulls.listCommits({

I confirmed that granting pull-requests: read permissions to my workflow was sufficient for the Fetch Metadata action: it resolved the access error.

[jeffwidman]

Thanks! Had no idea this default perm had changed.

I poked around a bit, and this appears to be the only place that needs changing. 👍