ci: probe GITHUB_TOKEN PR permission

Author: qinezh

.github/workflows/probe-github-token-pr.yml

@@ -0,0 +1,91 @@
+name: Probe GITHUB_TOKEN Pull Request Permission
+
+on:
+  push:
+    branches:
+      - qinezh/sync-foundry-canvas-probe
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  probe:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout main
+        uses: actions/checkout@v4
+        with:
+          ref: main
+          fetch-depth: 0
+
+      - name: Push temporary probe branch
+        id: branch
+        shell: bash
+        env:
+          PROBE_BRANCH: bot/github-token-pr-probe-${{ github.run_id }}-${{ github.run_attempt }}
+        run: |
+          set -euo pipefail
+
+          echo "name=$PROBE_BRANCH" >> "$GITHUB_OUTPUT"
+          git switch -c "$PROBE_BRANCH"
+
+          mkdir -p .github/token-probes
+          printf 'Workflow run: %s\n' "$GITHUB_RUN_ID" \
+            > ".github/token-probes/$GITHUB_RUN_ID.txt"
+
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add ".github/token-probes/$GITHUB_RUN_ID.txt"
+          git commit -m "ci: probe GITHUB_TOKEN pull request permission"
+          git push origin "HEAD:refs/heads/$PROBE_BRANCH"
+
+      - name: Create temporary draft pull request
+        id: pr
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PROBE_BRANCH: ${{ steps.branch.outputs.name }}
+        run: |
+          set -euo pipefail
+
+          response=$(gh api --method POST \
+            "repos/$GITHUB_REPOSITORY/pulls" \
+            -f title="GITHUB_TOKEN PR permission probe" \
+            -f head="$PROBE_BRANCH" \
+            -f base="main" \
+            -F draft=true \
+            -f body="Temporary automated probe from workflow run $GITHUB_RUN_ID.")
+
+          pr_number=$(jq -r '.number' <<< "$response")
+          pr_url=$(jq -r '.html_url' <<< "$response")
+          echo "number=$pr_number" >> "$GITHUB_OUTPUT"
+
+          {
+            echo "## GITHUB_TOKEN PR Permission"
+            echo
+            echo "Successfully created temporary draft PR [#$pr_number]($pr_url)."
+          } >> "$GITHUB_STEP_SUMMARY"
+
+      - name: Clean up temporary pull request and branch
+        if: always()
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PROBE_BRANCH: ${{ steps.branch.outputs.name }}
+          PR_NUMBER: ${{ steps.pr.outputs.number }}
+        run: |
+          set -u
+
+          if [[ -n "${PR_NUMBER:-}" ]]; then
+            gh api --method PATCH \
+              "repos/$GITHUB_REPOSITORY/pulls/$PR_NUMBER" \
+              -f state="closed"
+          fi
+
+          if [[ -n "${PROBE_BRANCH:-}" ]]; then
+            gh api --method DELETE \
+              "repos/$GITHUB_REPOSITORY/git/refs/heads/$PROBE_BRANCH" \
+              || true
+          fi