Fix add-comment and hide-comment to use issues:write instead of pull_requests:write by Copilot · Pull Request #16687 · github/gh-aw

Copilot · 2026-02-19T00:36:47Z

Fix add-comment and hide-comment permissions

Issue

The add-comment and hide-comment safe outputs incorrectly required pull_requests: write permission when they only need issues: write. PR comments are actually issue comments under the hood in GitHub's API.

Changes Made

Updated add_comment.go - Use NewPermissionsContentsReadIssuesWrite() when discussions are disabled
Updated safe_outputs_permissions.go - Applied same fix for both add-comment and hide-comment
Updated safe_outputs_permissions_test.go - Removed pull_requests: write from expected permissions
Updated notify_comment_test.go - Removed pull-requests: write expectation for add-comment
Updated compiler_safe_outputs_job_test.go - Removed pull-requests: write from add-comment and multiple safe output test cases

Original prompt

This section details on the original issue you should resolve

<issue_title>add-comment doesn't actually require pull_requests: write</issue_title>
<issue_description>When using the add-comment safe output, the compiler adds pull_requests: write to the required workflow permissions.

On GitHub you don't actually need pull_requests: write to add a comment to a pull request, just issues: write.

issues: write — lets you add regular comments on a PR (the main conversation thread), since those are issue comments under the hood

pull_requests: write — needed for PR-specific actions like creating review comments (inline code comments), submitting reviews, updating the PR branch, etc.</issue_description>

<agent_instructions>Add test for this case to prevent regression.</agent_instructions>

Comments on the Issue (you are @copilot in this section)

Fixes add-comment doesn't actually require pull_requests: write #16673

🔒 GitHub Advanced Security automatically protects Copilot coding agent pull requests. You can protect all pull requests by enabling Advanced Security for your repositories. Learn more about Advanced Security.

Fix add-comment and hide-comment to use issues:write instead of pull_requests:write

Fix add-comment and hide-comment permissions

Issue

The add-comment and hide-comment safe outputs incorrectly required pull_requests: write permission when they only need issues: write. PR comments are actually issue comments under the hood in GitHub's API.

Changes Made

Updated add_comment.go - Use NewPermissionsContentsReadIssuesWrite() when discussions are disabled
Updated safe_outputs_permissions.go - Applied same fix for both add-comment and hide-comment
Updated safe_outputs_permissions_test.go - Removed pull_requests: write from expected permissions
Updated notify_comment_test.go - Removed pull-requests: write expectation for add-comment
Updated compiler_safe_outputs_job_test.go - Removed pull-requests: write from add-comment and multiple safe output test cases

Original prompt

This section details on the original issue you should resolve

(issue_title)add-comment doesn't actually require pull_requests: write(/issue_title)
(issue_description)When using the add-comment safe output, the compiler adds pull_requests: write to the required workflow permissions.

On GitHub you don't actually need pull_requests: write to add a comment to a pull request, just issues: write.

issues: write — lets you add regular comments on a PR (the main conversation thread), since those are issue comments under the hood

pull_requests: write — needed for PR-specific actions like creating review comments (inline code comments), submitting reviews, updating the PR branch, etc.(/issue_description)

(agent_instructions)Add test for this case to prevent regression.(/agent_instructions)

Comments on the Issue (you are @copilot in this section)

(comments)
(/comments)

Fixes add-comment doesn't actually require pull_requests: write #16673

Changeset

Type: patch
Description: Fix add-comment and hide-comment safe outputs to request issues:write instead of pull_requests:write.

Generated by Changeset Generator

✨ PR Review Safe Output Test - Run 22164908321

💥 [THE END] — Illustrated by Smoke Claude

…ead of pull_requests:write Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot

Pull request overview

This PR fixes a permissions issue where add-comment and hide-comment safe outputs incorrectly requested pull_requests: write permission. Since PR comments are issue comments in GitHub's API, only issues: write is required.

Changes:

Updated permission computation for add-comment and hide-comment to use issues: write instead of pull_requests: write when discussions: false
Added explanatory comments clarifying that PR comments are issue comments
Updated test expectations to reflect the corrected permission requirements

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
pkg/workflow/safe_outputs_permissions.go	Fixed permission computation for both `add-comment` and `hide-comment` to use `NewPermissionsContentsReadIssuesWrite()` when discussions are disabled
pkg/workflow/add_comment.go	Updated add-comment job builder to use correct permissions helper function
pkg/workflow/safe_outputs_permissions_test.go	Removed `PermissionPullRequests: PermissionWrite` from test expectations for add-comment and hide-comment

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

pkg/workflow/safe_outputs_permissions_test.go

pelikhan · 2026-02-19T00:54:41Z

@copilot fix test failures in https://github.com/github/gh-aw/actions/runs/22163965834/job/64087057491

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-02-19T01:00:26Z

@copilot fix test failures in https://github.com/github/gh-aw/actions/runs/22163965834/job/64087057491

Fixed in commit 33201fe. Updated pkg/workflow/notify_comment_test.go to remove the check for pull-requests: write permission when add-comment is configured. The test now correctly expects only issues: write and discussions: write permissions.

pelikhan · 2026-02-19T01:08:29Z

@copilot:claude-sonnet-4.5 fix tests in https://github.com/github/gh-aw/actions/runs/22164300562/job/64088091764?pr=16687

Copilot · 2026-02-19T01:08:32Z

@pelikhan The model sweagent-capi is not available for your account. This can happen if the model was disabled by your organization's policy or if your Copilot plan doesn't include access to it.

You can try again without specifying a model (just @copilot) to use the default, or choose a different model from the model picker.

If you want to contact GitHub about this error, please mention the following identifier so they can better serve you: ab09b6c5-a9e7-4fd3-9fca-93b85efbd256

pelikhan · 2026-02-19T01:15:54Z

@copilot:claude-sonnet-4.5 fix tests in https://github.com/github/gh-aw/actions/runs/22164300562/job/64088091764?pr=16687

Copilot · 2026-02-19T01:15:57Z

@pelikhan The model sweagent-capi is not available for your account. This can happen if the model was disabled by your organization's policy or if your Copilot plan doesn't include access to it.

You can try again without specifying a model (just @copilot) to use the default, or choose a different model from the model picker.

If you want to contact GitHub about this error, please mention the following identifier so they can better serve you: a15cde3d-1f05-4988-88ef-c2aa15947b10

pelikhan · 2026-02-19T01:16:11Z

@copilot fix tests in https://github.com/github/gh-aw/actions/runs/22164300562/job/64088091764?pr=16687

…ctation for add-comment Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-02-19T01:21:02Z

@copilot fix tests in https://github.com/github/gh-aw/actions/runs/22164300562/job/64088091764?pr=16687

Fixed in commit d1d759c. Updated pkg/workflow/compiler_safe_outputs_job_test.go to remove the pull-requests: write expectation for add-comment test cases. The test now correctly expects only issues: write and discussions: write permissions.

github-actions · 2026-02-19T01:32:40Z

📰 BREAKING: Smoke Copilot is now investigating this pull request. Sources say the story is developing...

github-actions · 2026-02-19T01:32:42Z

🧪 Smoke Project is now testing project operations...

github-actions · 2026-02-19T01:32:43Z

🧪 Smoke Temporary ID is now testing temporary ID functionality...

github-actions · 2026-02-19T01:32:45Z

✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟

github-actions · 2026-02-19T01:32:46Z

🎬 THE END — Smoke Claude MISSION: ACCOMPLISHED! The hero saves the day! ✨

github-actions · 2026-02-19T01:36:03Z

✅ Smoke Project completed successfully. All project operations validated.

github-actions · 2026-02-19T01:36:43Z

Smoke test results:
PR: #16699 Remove GitHub API call from CLI initialization hot path
PR: #16690 Add blocked pattern matching for add-labels and remove-labels
GitHub MCP: ✅
Serena MCP (activate + find_symbol): ✅
Playwright (title contains GitHub): ✅
File write: ✅
Bash cat: ✅
Build (make build): ✅
Overall: PASS

🔮 The oracle has spoken through Smoke Codex for issue #16687

github-actions · 2026-02-19T01:37:17Z

Smoke test results for @app/copilot-swe-agent:

Test
GitHub MCP	✅
safeinputs-gh	✅
Playwright	✅
File write/read	✅
Discussion comment	✅
Build	✅
Create discussion	✅
Haiku dispatch	✅
PR review	✅

Overall: PASS

📰 BREAKING: Report filed by Smoke Copilot for issue #16687

github-actions

This PR correctly removes pull-requests: write from add-comment and hide-comment safe-output jobs. These operations only need issues: write — good least-privilege fix applied consistently across all affected workflow files.

📰 BREAKING: Report filed by Smoke Copilot for issue #16687

github-actions · 2026-02-19T01:37:18Z

.github/workflows/agent-performance-analyzer.lock.yml

      discussions: write
      issues: write
-      pull-requests: write
    outputs:


✅ Good fix — add_comment and hide_comment operations only require issues:write, not pull_requests:write. Removing the overly-broad permission follows the principle of least privilege.

github-actions · 2026-02-19T01:37:48Z

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

github-actions · 2026-02-19T01:39:33Z

Smoke Test Results - Run §22164908321

Overall: PARTIAL

💥 [THE END] — Illustrated by Smoke Claude for issue #16687

github-actions

💥 Automated smoke test review - all systems nominal!

💥 [THE END] — Illustrated by Smoke Claude for issue #16687

Initial plan

83b756b

Copilot AI assigned Copilot and pelikhan Feb 19, 2026

Copilot started work on behalf of pelikhan February 19, 2026 00:36 View session

Fix add-comment and hide-comment permissions to use issues:write inst…

985f677

…ead of pull_requests:write Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Fix permissions for add-comment functionality~~ Fix add-comment and hide-comment to use issues:write instead of pull_requests:write Feb 19, 2026

Copilot finished work on behalf of pelikhan February 19, 2026 00:49

pelikhan marked this pull request as ready for review February 19, 2026 00:50

Copilot AI review requested due to automatic review settings February 19, 2026 00:50

Merge branch 'main' into copilot/fix-add-comment-permissions

1d50ca8

Copilot started reviewing on behalf of pelikhan February 19, 2026 00:50 View session

Copilot AI reviewed Feb 19, 2026

View reviewed changes

pkg/workflow/safe_outputs_permissions_test.go Show resolved Hide resolved

Merge branch 'main' into copilot/fix-add-comment-permissions

edb40a9

Copilot started work on behalf of pelikhan February 19, 2026 00:54 View session

Fix notify_comment_test to reflect correct add-comment permissions

33201fe

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan February 19, 2026 01:01

Merge branch 'main' into copilot/fix-add-comment-permissions

b1427bd

Copilot started work on behalf of pelikhan February 19, 2026 01:16 View session

github-actions bot mentioned this pull request Feb 19, 2026

Smoke Test: Copilot - 22164477402 #16701

Closed

Fix compiler_safe_outputs_job_test to remove pull-requests:write expe…

d1d759c

…ctation for add-comment Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan February 19, 2026 01:21

Merge branch 'main' into copilot/fix-add-comment-permissions

21e31c9

pelikhan added the smoke label Feb 19, 2026

This was referenced Feb 19, 2026

[smoke-temporary-id] Test Parent: Temporary ID Validation #16706

Closed

[smoke-temporary-id] Sub-Issue 1: Test Temporary ID References #16708

Closed

[smoke-temporary-id] Sub-Issue 2: Test Different ID Length #16709

Closed

Add changeset [skip-ci]

8c6d4f9

github-actions bot added smoke-codex and removed smoke labels Feb 19, 2026

github-actions bot mentioned this pull request Feb 19, 2026

Smoke Test: Copilot - 22164908280 #16712

Closed

github-actions bot added the smoke-copilot label Feb 19, 2026

github-actions bot reviewed Feb 19, 2026

View reviewed changes

github-actions bot mentioned this pull request Feb 19, 2026

Smoke Test: Claude - 22164908321 #16713

Closed

github-actions bot added the smoke-claude label Feb 19, 2026

github-actions bot reviewed Feb 19, 2026

View reviewed changes

pelikhan merged commit a3a9468 into main Feb 19, 2026
1 check passed

pelikhan deleted the copilot/fix-add-comment-permissions branch February 19, 2026 01:40

Conversation

Copilot AI commented Feb 19, 2026 • edited by github-actions bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Fix add-comment and hide-comment permissions

Issue

Changes Made

Comments on the Issue (you are @copilot in this section)

Fix add-comment and hide-comment permissions

Issue

Changes Made

Comments on the Issue (you are @copilot in this section)

Changeset

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

pelikhan commented Feb 19, 2026

Uh oh!

Copilot AI commented Feb 19, 2026

Uh oh!

pelikhan commented Feb 19, 2026

Uh oh!

Copilot AI commented Feb 19, 2026

Uh oh!

pelikhan commented Feb 19, 2026

Uh oh!

Copilot AI commented Feb 19, 2026

Uh oh!

pelikhan commented Feb 19, 2026

Uh oh!

Copilot AI commented Feb 19, 2026

Uh oh!

github-actions bot commented Feb 19, 2026

Uh oh!

github-actions bot commented Feb 19, 2026

Uh oh!

github-actions bot commented Feb 19, 2026

Uh oh!

github-actions bot commented Feb 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Feb 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Feb 19, 2026

Uh oh!

github-actions bot commented Feb 19, 2026

Uh oh!

github-actions bot commented Feb 19, 2026

Uh oh!

github-actions bot left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions bot Feb 19, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Feb 19, 2026

Uh oh!

github-actions bot commented Feb 19, 2026

Smoke Test Results - Run §22164908321

Uh oh!

github-actions bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Comments

Copilot AI commented Feb 19, 2026 •

edited by github-actions bot

Loading

Comments on the Issue (you are `@copilot` in this section)

github-actions bot commented Feb 19, 2026 •

edited

Loading

github-actions bot commented Feb 19, 2026 •

edited

Loading