From 88b412ec595ef1ade6afc157c028328216a80f50 Mon Sep 17 00:00:00 2001
From: Jarod Taylor <jarodrtaylor@gmail.com>
Date: Mon, 8 Jun 2026 21:23:07 -0500
Subject: [PATCH] fix(ci): grant Claude Code Action write perms so reviews can
 post
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Both workflows shipped with read-only `permissions:` (pull-requests/issues:
read). claude-code-action scopes its GitHub App token down to the workflow's
declared permissions, so the review ran but every attempt to post the review
was denied — the run exited success with permission_denials_count: 17 and no
comment ever appeared.

Bring both to Anthropic's canonical example permissions:
- claude-code-review.yml: pull-requests + issues → write
- claude.yml: contents + pull-requests + issues → write
Also bump actions/checkout v4 → v6 (clears the Node 20 deprecation warning).
---
 .github/workflows/claude-code-review.yml | 6 +++---
 .github/workflows/claude.yml             | 8 ++++----
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/claude-code-review.yml b/.github/workflows/claude-code-review.yml
index b5e8cfd..0715104 100644
--- a/.github/workflows/claude-code-review.yml
+++ b/.github/workflows/claude-code-review.yml
@@ -21,13 +21,13 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read
-      pull-requests: read
-      issues: read
+      pull-requests: write
+      issues: write
       id-token: write
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: 1
 
diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml
index 6b15fac..194dd6f 100644
--- a/.github/workflows/claude.yml
+++ b/.github/workflows/claude.yml
@@ -19,14 +19,14 @@ jobs:
       (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
     runs-on: ubuntu-latest
     permissions:
-      contents: read
-      pull-requests: read
-      issues: read
+      contents: write
+      pull-requests: write
+      issues: write
       id-token: write
       actions: read # Required for Claude to read CI results on PRs
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: 1