fix(ci): Draft PR Label Cleanup workflow lacks pull-requests: write, label removal 403s

[exploreriii]

Description

The Draft PR Label Cleanup workflow (added in #2573) fails with 403 Resource not accessible by integration when stripping queue labels from a PR converted to draft (e.g. run on PR #2332):

Cleaning draft PR #2332...
DELETE /repos/hiero-ledger/hiero-sdk-python/issues/2332/labels/queue%3Ajunior-committer - 403
Error: Failed to clean draft PR #2332: Resource not accessible by integration

Cause

.github/workflows/draft-label-cleanup.yml declares:

permissions:
  issues: write
  pull-requests: read

GitHub routes issues-API calls that target a pull request (like issues.removeLabel) through the pull-requests permission, so pull-requests: write is required. review-sync.yml performs the same operation successfully because it declares both.

Fix

Change pull-requests: read → pull-requests: write in .github/workflows/draft-label-cleanup.yml.

[github-actions]

Thanks for your submission.

This issue is awaiting approval from @hiero-ledger/hiero-sdk-python-triage and @hiero-ledger/hiero-sdk-python-committers and @hiero-ledger/hiero-sdk-python-maintainers.

[github-actions]

👋 Hello Team 👋

@hiero-ledger/hiero-sdk-good-first-issue-support

A new Good First Issue Candidate has been created. Please review it and confirm whether it should be labeled as a Good First Issue.

Repository: hiero-ledger/hiero-sdk-python
Issue: #2592 - fix(ci): Draft PR Label Cleanup workflow lacks pull-requests: write, label removal 403s

Best Regards,
Hiero Python SDK team

[github-actions]

Approved by @hiero-ledger/hiero-sdk-python-triage and @hiero-ledger/hiero-sdk-python-committers and @hiero-ledger/hiero-sdk-python-maintainers.

[github-actions]

@coderabbitai plan

[coderabbitai]

Coding Plan

Summary

Change one permission value in .github/workflows/draft-label-cleanup.yml from pull-requests: read to pull-requests: write to fix the 403 error during label removal.

Add a short explanatory comment so the required scope is clear to future maintainers.

No changes are needed in the JavaScript helpers, because stripQueueLabels() and removeLabel already work correctly. Only the workflow token scope is insufficient.

Implementation Steps

Correct workflow permissions

This phase aligns the Draft PR Label Cleanup workflow permissions with the other label-mutation workflows in the repository. The goal is to grant the write scope that the Issues-API label removal call requires for a pull request target.

Task 1: Grant `pull-requests: write` in the draft label cleanup workflow

Update the workflow so its token can remove labels from a PR that is converted to draft.

• Edit the permissions block in .github/workflows/draft-label-cleanup.yml.
• Change pull-requests: read to pull-requests: write.
• Keep issues: write and contents: read unchanged.
• The resulting permission set matches the pattern in review-sync.yml, which performs the same issues.removeLabel operation successfully.

Task 2: Document the permission rationale in the workflow

Add a short comment so future maintainers understand why pull-requests: write is required.

• Add a brief comment near the permissions block in .github/workflows/draft-label-cleanup.yml.
• State that GitHub routes issues.removeLabel calls that target a pull request through the pull-requests permission scope.
• State that pull-requests: write is therefore required for label removal, even though the call uses the Issues API.
• This comment prevents a future revert to pull-requests: read and complements the existing comment about the pull_request_target token behavior.

🤖 Prompt for AI agents

Implement the fix for the `Draft PR Label Cleanup` workflow 403 error. The goal
is to grant the correct permission scope so label removal calls succeed.

- Open `.github/workflows/draft-label-cleanup.yml`.
- In the `permissions` block, change `pull-requests: read` to `pull-requests:
write`.
- Do not change `issues: write`. Do not change `contents: read`. Keep both
values as they are.
- Verify that the resulting permission block matches the pattern used in
`review-sync.yml`, which performs the same `issues.removeLabel` operation
without error.
- Add a short comment near the `permissions` block. The comment must state that
GitHub routes `issues.removeLabel` calls that target a pull request through the
*pull-requests* permission scope. The comment must also state that
`pull-requests: write` is required for label removal, even though the call uses
the Issues API.
- Place this comment so it complements the existing comment about the
`pull_request_target` token behavior. Do not remove the existing comment.
- Do not modify any JavaScript helper files. The functions `stripQueueLabels()`
and `removeLabel` in `.github/scripts/review-sync/helpers/labels.js` already
work correctly and require no code changes.

Research

The repository uses GitHub Actions workflows in .github/workflows/ and shared JavaScript helpers in .github/scripts/.

The draft-label-cleanup.yml workflow triggers on converted_to_draft. It checks out the scripts and runs on-converted-to-draft.js. This script calls stripQueueLabels() in .github/scripts/review-sync/helpers/labels.js. This function uses github.rest.issues.removeLabel(...) with the PR number as issue_number.

GitHub routes such Issues-API calls that target a pull request through the pull-requests permission scope.

The related review-sync.yml and sync-issue-labels-add.yml workflows already declare both issues: write and pull-requests: write. The draft-label-cleanup.yml workflow is the outlier. It declares only pull-requests: read. This causes the 403 error.

---

🚀 Next Steps

🤖 All AI agent prompts combined

Implement the fix for the `Draft PR Label Cleanup` workflow 403 error. The goal
is to grant the correct permission scope so label removal calls succeed.

- Open `.github/workflows/draft-label-cleanup.yml`.
- In the `permissions` block, change `pull-requests: read` to `pull-requests:
write`.
- Do not change `issues: write`. Do not change `contents: read`. Keep both
values as they are.
- Verify that the resulting permission block matches the pattern used in
`review-sync.yml`, which performs the same `issues.removeLabel` operation
without error.
- Add a short comment near the `permissions` block. The comment must state that
GitHub routes `issues.removeLabel` calls that target a pull request through the
*pull-requests* permission scope. The comment must also state that
`pull-requests: write` is required for label removal, even though the call uses
the Issues API.
- Place this comment so it complements the existing comment about the
`pull_request_target` token behavior. Do not remove the existing comment.
- Do not modify any JavaScript helper files. The functions `stripQueueLabels()`
and `removeLabel` in `.github/scripts/review-sync/helpers/labels.js` already
work correctly and require no code changes.

💡 Iterate on the plan with: `@coderabbitai` <feedback>

Example Feedback
- `@coderabbitai` You can skip phase 3. Add a simple unit test case for phase 2.
- `@coderabbitai` For design choice 1 go ahead with option 3 and replan.

---