Inquiry Regarding Github Actions Permissions for Pull Request

[ono-max]

Select Topic Area

Question

Body

Hello,

I am seeking clarification on the permissions associated with pull_request events in Github Actions, specifically regarding write permissions. The documentation states:

You can use the permissions key to add and remove read permissions for forked repositories, but typically you can't grant write access.

Link to documentation

However another section of the documentation suggests otherwise:

By default, GitHub Actions workflows triggered by Dependabot get a GITHUB_TOKEN with read-only permissions. You can use the permissions key in your workflow to increase the access for the token.

Link to documentation

Based on this information and this blog, I inferred that only Dependabot has special privileges to receive write permission when creating a pull request from a forked repository. To test this hypothesis, I conducted the following experiment:

First, I created a YAML file that enables auto-merging pull requests:

on:
  push:
    branches: [ "main" ]
  pull_request:
    branches: [ "main" ]

jobs:
  build:
    # Node.js CI workflow...
    ...

  dependabot:
    needs: build
    runs-on: ubuntu-latest
    if: ${{ github.event_name == 'pull_request' }}
    permissions:
      contents: write
      pull-requests: write
    steps:
      - name: Enable auto-merge for Dependabot PRs
        run : |
          gh pr review --approve "$PR_URL"
          gh pr merge --auto --rebase "$PR_URL"
        env:
          PR_URL: ${{github.event.pull_request.html_url}}
          GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}

Then, I created the following pull requests:

1. Checked whether a forked pull request by a personal account is merged or not -> not merged
2. Checked whether a forked pull request by Dependabot is merged or not -> merged
3. Checked whether a forked pull request by Renovate is merged or not -> merged

The result for case 3 is confusing to me because I assumed that only pull requests triggered by Dependabot are treated as special. Despite being from forked repository, the pull request by Renovate was granted write permission.

Could you provide insights into this behavior? Thank you.

[github-actions[bot]]

🕒 Discussion Activity Reminder 🕒

This Discussion has been labeled as dormant by an automated system for having no activity in the last 60 days. Please consider one the following actions:

1️⃣ Close as Out of Date: If the topic is no longer relevant, close the Discussion as out of date at the bottom of the page.

2️⃣ Provide More Information: Share additional details or context — or let the community know if you've found a solution on your own.

3️⃣ Mark a Reply as Answer: If your question has been answered by a reply, mark the most helpful reply as the solution.

Note: This dormant notification will only apply to Discussions with the Question label. To learn more, see our recent announcement.

Thank you for helping bring this Discussion to a resolution! 💬

[jku]

I believe cases 2 and 3 are not actually from forks: both branches are in the upstream repository.