Fix contribution-check workflow compilation: use read-only PR permission

[Copilot]

The install-gh-aw workflow was failing at the compilation step due to workflows/contribution-check.md using pull-requests: write permission, which is disallowed in strict mode.

Changes

• Changed pull-requests: write to pull-requests: read in workflows/contribution-check.md

The workflow already uses safe-outputs for all write operations (add-comment, add-labels, create-issue), so write permission was unnecessary. Read permission is sufficient for the GitHub toolsets to fetch PR data.

 permissions:
   contents: read
   issues: read
-  pull-requests: write
+  pull-requests: read

Compilation now succeeds: 29 workflows, 0 errors.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/repos/github/gh-aw/git/ref/tags/v0.45.4
  • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v0.45.4 --jq .object.sha (http block)
  • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v0.45.4 --jq .object.sha d -n 10 (http block)
  • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v0.45.4 --jq .object.sha TOKEN"; }; f storemote.origin.url TOKEN"; }; f store (http block)
• https://api.github.com/user
  • Triggering command: /usr/bin/gh gh api user --jq .login (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

Fix the failing GitHub Actions workflow install-gh-aw
Analyze the workflow logs, identify the root cause of the failure, and implement a fix.
Job ID: 63864183896
Job URL: https://github.com/githubnext/agentics/actions/runs/22099217007/job/63864183896

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.