Is labels related permission removed from pull request?

[harupy]

Select Topic Area

Question

Body

Hope this is the right place to ask this question. We ran into the following error where adding a label to a PR fails with 403:

https://github.com/mlflow/mlflow/actions/runs/14347729040/job/40220600326?pr=15251

RequestError [HttpError]: You do not have permission to create labels on this repository.: {"resource":"Repository","field":"label","code":"unauthorized"}
    at /home/runner/work/_actions/actions/github-script/v7/dist/index.js:9537:21
    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
    at async module.exports (/home/runner/work/mlflow/mlflow/.github/workflows/patch.js:62:3)
    at async eval (eval at callAsyncFunction (/home/runner/work/_actions/actions/github-script/v7/dist/index.js:35424:16), <anonymous>:4:1)
    at async main (/home/runner/work/_actions/actions/github-script/v7/dist/index.js:35522:20) {
  status: 403,
  response: {
    url: 'https://api.github.com/repos/mlflow/mlflow/issues/15251/labels',
    status: 403,
    headers: {
      'access-control-allow-origin': '*',
      'access-control-expose-headers': 'ETag, Link, Location, Retry-After, X-GitHub-OTP, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Used, X-RateLimit-Resource, X-RateLimit-Reset, X-OAuth-Scopes, X-Accepted-OAuth-Scopes, X-Poll-Interval, X-GitHub-Media-Type, X-GitHub-SSO, X-GitHub-Request-Id, Deprecation, Sunset',
      'content-encoding': 'gzip',
      'content-security-policy': "default-src 'none'",
      'content-type': 'application/json; charset=utf-8',
      date: 'Wed, 09 Apr 2025 02:37:29 GMT',
      'referrer-policy': 'origin-when-cross-origin, strict-origin-when-cross-origin',
      server: 'github.com',
      'strict-transport-security': 'max-age=31536000; includeSubdomains; preload',
      'transfer-encoding': 'chunked',
      vary: 'Accept-Encoding, Accept, X-Requested-With',
      'x-accepted-github-permissions': 'issues=write; pull_requests=write',
      'x-content-type-options': 'nosniff',
      'x-frame-options': 'deny',
      'x-github-api-version-selected': '2022-11-28',
      'x-github-media-type': 'github.v3; format=json',
      'x-github-request-id': 'B801:1ADA51:AA4429:AF2C10:67F5DD69',
      'x-ratelimit-limit': '15000',
      'x-ratelimit-remaining': '[14](https://github.com/mlflow/mlflow/actions/runs/14347729040/job/40220600326?pr=15251#step:3:15)979',
      'x-ratelimit-reset': '1744168993',
      'x-ratelimit-resource': 'core',
      'x-ratelimit-used': '21',
      'x-xss-protection': '0'
    },
    data: {
      message: 'You do not have permission to create labels on this repository.',
      errors: [Array],
      documentation_url: 'https://docs.github.com/v3/issues/labels/',
      status: '403'
    }
  },
  request: {
    method: 'POST',
    url: 'https://api.github.com/repos/mlflow/mlflow/issues/[15](https://github.com/mlflow/mlflow/actions/runs/14347729040/job/40220600326?pr=15251#step:3:16)251/labels',
    headers: {
      accept: 'application/vnd.github.v3+json',
      'user-agent': 'actions/github-script octokit-core.js/5.0.1 Node.js/20.19.0 (linux; x64)',
      authorization: 'token [REDACTED]',
      'content-type': 'application/json; charset=utf-8'
    },
    body: '{"labels":["v2.21.4"]}',
    request: {
      agent: [Agent],
      fetch: [Function: proxyFetch],
      hook: [Function: bound bound register]
    }
  }
}

Our workflow explicitly sets pull-requests:write:

https://github.com/mlflow/mlflow/blob/b48e226348471dbb07c837c62544534e647ce91e/.github/workflows/patch.yml#L18-L19

jobs:
  patch:
    if: github.event.pull_request.draft == false
    runs-on: ubuntu-latest
    permissions:
      pull-requests: write

googleapis/release-please-action#1105 reports the same issue.

[ebndev]

Hi @harupy, thanks for being a part of the GitHub Community!

It looks like users have been able to resolve the issue with this comment. Have you tried that?

[harupy]

@ebndev Thanks for the comment. issues: write worked, but this seems like a breaking change. Curious if this change is really intended or not.

[keelerm84]

@ebndev I would also mention that the official docs suggest either issue: write or pull-requests: write should be sufficient. Is that documentation out of date, given the change mentioned here?

[boonya]

issue: write works for me. Thanks

[glasser]

While there is a workaround, the docs do continue to be inaccurate.

[karpikpl]

this is really confusing because workflow with

permissions:
    contents: read
    pull-requests: write

Both actions are using same token

Action adding label using this code works:

  core.info(`Adding label (${name}) to PR...`);
  const addLabelResponse = await octokit.rest.issues.addLabels({
    owner: context.repo.owner,
    repo: context.repo.repo,
    issue_number: context.issue.number,
    labels: [name],
  });

https://github.com/thehanimo/pr-title-checker/blob/7fbfe05602bdd86f926d3fb3bccb6f3aed43bc70/index.ts#L85-L91

but this one fails:

    const client = new github.GitHub(githubToken);
    await client.issues.addLabels({
      labels,
      owner,
      repo,
      issue_number: number
    });
  } catch (e) {

https://github.com/actions-ecosystem/action-add-labels/blob/18f1af5e3544586314bbe15c0273249c770b2daf/src/main.ts#L22-L29s

[github-actions[bot]]

🕒 Discussion Activity Reminder 🕒

This Discussion has been labeled as dormant by an automated system for having no activity in the last 60 days. Please consider one the following actions:

1️⃣ Close as Out of Date: If the topic is no longer relevant, close the Discussion as out of date at the bottom of the page.

2️⃣ Provide More Information: Share additional details or context — or let the community know if you've found a solution on your own.

3️⃣ Mark a Reply as Answer: If your question has been answered by a reply, mark the most helpful reply as the solution.

Note: This dormant notification will only apply to Discussions with the Question label. To learn more, see our recent announcement.

Thank you for helping bring this Discussion to a resolution! 💬

[github-actions[bot]]

🕒 Discussion Activity Reminder 🕒

This Discussion has been labeled as dormant by an automated system for having no activity in the last 60 days. Please consider one the following actions:

1️⃣ Close as Out of Date: If the topic is no longer relevant, close the Discussion as out of date at the bottom of the page.

2️⃣ Provide More Information: Share additional details or context — or let the community know if you've found a solution on your own.

3️⃣ Mark a Reply as Answer: If your question has been answered by a reply, mark the most helpful reply as the solution.

Note: This dormant notification will only apply to Discussions with the Question label. To learn more, see our recent announcement.

Thank you for helping bring this Discussion to a resolution! 💬

[glasser]

The docs do still say that ""Pull requests" repository permissions (write)" allows you to create labels.

[github-actions[bot]]

🕒 Discussion Activity Reminder 🕒

This Discussion has been labeled as dormant by an automated system for having no activity in the last 60 days. Please consider one the following actions:

1️⃣ Close as Out of Date: If the topic is no longer relevant, close the Discussion as out of date at the bottom of the page.

2️⃣ Provide More Information: Share additional details or context — or let the community know if you've found a solution on your own.

3️⃣ Mark a Reply as Answer: If your question has been answered by a reply, mark the most helpful reply as the solution.

Note: This dormant notification will only apply to Discussions with the Question label. To learn more, see our recent announcement.

Thank you for helping bring this Discussion to a resolution! 💬