GITHUB_TOKEN requires repository-projects: read to work properly

[Aaron-Ritter]

Environment details

• Programming language: release-type simple
• OS: ubuntu-latest
• Package version: [email protected]

Steps to reproduce

Create a basic workflow with release-please-action with secrets.GITHUB_TOKEN as a token and release-type simple.

Set the suggested permissions:

permissions:
  contents: write
  pull-requests: write

The workflow will create a PR but not be able to set a label and sub-sequential can't set a tag and create a release either.

When adding the additional permission it starts to work:

  repository-projects: read

no clue why.. this is why i tried it: cli/cli#5307 all thought my repository is not private but public.

[Aaron-Ritter]

possibly related cli/cli#9166

[Aaron-Ritter]

update, this seems only to work when you run it with a PAT once because this creates the labels, otherwise this work around wont work either.

btw. i tried with write-all permissions https://github.com/Aaron-Ritter/example-app-release-please and it does not work. so something is wrong with creating the labels in the first place and not applying them.

[Aaron-Ritter]

when you manually create two labels autorelease: pending and autorelease: tagged it starts working

[dy0gu]

I tried adding repository-projects: read to my workflow and it still did not work, manually creating the labels appears to be the only fix at the moment.

Seems it is GitHub that broke label creation permissions on the GITHUB_TOKEN, not really a release-please issue, see here for other people experiencing the same with other actions: https://github.com/orgs/community/discussions/149877#discussioncomment-11952379