From bbe49339b81aa7acc13612d78ace0e4cfcaaaa6b Mon Sep 17 00:00:00 2001
From: zowoq <59103226+zowoq@users.noreply.github.com>
Date: Sun, 11 Sep 2022 17:01:47 +1000
Subject: [PATCH] .github/workflows: fix permissions

the merge actions comment on pull requests, seems this was broken by 2c71278a2395d6d8c4e06d1ebe4de1ffdae727c7

also:
- fix permissions on new manual rendering action
- drop unnecessary issues permission from the terraform action
---
 .github/workflows/manual-rendering.yml           | 2 +-
 .github/workflows/periodic-merge-24h.yml         | 2 +-
 .github/workflows/periodic-merge-6h.yml          | 2 +-
 .github/workflows/update-terraform-providers.yml | 3 +--
 4 files changed, 4 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/manual-rendering.yml b/.github/workflows/manual-rendering.yml
index 4f5486f2acff..5d2518dffc04 100644
--- a/.github/workflows/manual-rendering.yml
+++ b/.github/workflows/manual-rendering.yml
@@ -13,7 +13,7 @@ permissions:
 jobs:
   check-rendering-equivalence:
     permissions:
-      issues: write  # for peter-evans/create-or-update-comment to create or update comment
+      pull-requests: write  # for peter-evans/create-or-update-comment to create or update comment
     if: github.repository_owner == 'NixOS'
     runs-on: ubuntu-latest
     steps:
diff --git a/.github/workflows/periodic-merge-24h.yml b/.github/workflows/periodic-merge-24h.yml
index 2eec69f65257..e8ec13496025 100644
--- a/.github/workflows/periodic-merge-24h.yml
+++ b/.github/workflows/periodic-merge-24h.yml
@@ -21,7 +21,7 @@ jobs:
   periodic-merge:
     permissions:
       contents: write  # for devmasx/merge-branch to merge branches
-      issues: write  # for peter-evans/create-or-update-comment to create or update comment
+      pull-requests: write  # for peter-evans/create-or-update-comment to create or update comment
     if: github.repository_owner == 'NixOS'
     runs-on: ubuntu-latest
     strategy:
diff --git a/.github/workflows/periodic-merge-6h.yml b/.github/workflows/periodic-merge-6h.yml
index bcc9f4883588..764ccaec0dfc 100644
--- a/.github/workflows/periodic-merge-6h.yml
+++ b/.github/workflows/periodic-merge-6h.yml
@@ -21,7 +21,7 @@ jobs:
   periodic-merge:
     permissions:
       contents: write  # for devmasx/merge-branch to merge branches
-      issues: write  # for peter-evans/create-or-update-comment to create or update comment
+      pull-requests: write  # for peter-evans/create-or-update-comment to create or update comment
     if: github.repository_owner == 'NixOS'
     runs-on: ubuntu-latest
     strategy:
diff --git a/.github/workflows/update-terraform-providers.yml b/.github/workflows/update-terraform-providers.yml
index 1650f537b7bc..1ae78a4fb8f8 100644
--- a/.github/workflows/update-terraform-providers.yml
+++ b/.github/workflows/update-terraform-providers.yml
@@ -12,8 +12,7 @@ jobs:
   tf-providers:
     permissions:
       contents: write  # for peter-evans/create-pull-request to create branch
-      issues: write  # for peter-evans/create-or-update-comment to create or update comment
-      pull-requests: write  # for peter-evans/create-pull-request to create a PR
+      pull-requests: write  # for peter-evans/create-pull-request to create a PR, for peter-evans/create-or-update-comment to create or update comment
     if: github.repository_owner == 'NixOS' && github.ref == 'refs/heads/master' # ensure workflow_dispatch only runs on master
     runs-on: ubuntu-latest
     steps: