Grant workflows write access so Claude can post PR comments

[jonnyspicer]

Problem

The Claude Code Review workflow succeeds on every PR but posts no comment. The run log shows the review runs and analyses the diff, then hits "permission_denials_count": 1 when it tries to post. Cause: the GitHub App scaffold ships both workflows with a read-only token:

GITHUB_TOKEN Permissions
  PullRequests: read   ← can read the diff, cannot post
  Issues: read

The job still goes green because a failed post isn't a job failure — so "success + no comment" is this misconfig, not a clean review.

Fix

Bump pull-requests and issues to write on both workflows (claude-code-review.yml and claude.yml).

Why this must land on main

claude-code-action refuses to run when the workflow file on a PR branch differs from the copy on the default branch (a self-modification guard against secret exfiltration). So this change cannot be validated on its own PR — it takes effect on the next normal PR opened after it merges to main.

Security note

pull-requests: write on a pull_request trigger is sensitive only if this repo accepts fork PRs. This is a private, internal-only org repo with no forks, so the risk is negligible. If external forks are expected later, switch to pull_request_target with author restrictions.

🤖 Generated with Claude Code