Workflow labels.yml grants pull-requests: read that no step uses #28194

Prerequisites

• Write a descriptive title.
• Make sure you are able to repro it on the latest released version
• Search the existing issues.
• Refer to the FAQ.
• Refer to Differences between Windows PowerShell 5.1 and PowerShell.

Steps to reproduce

In .github/workflows/labels.yml

Finding

pull-requests: read has no consumer.

The script reads context.payload.pull_request.labels. The labels are already in the webhook payload the runner receives; reading them does not touch the REST API, so no permission authorises anything here. pull-requests: read would only be needed if the script called something like pulls.get or issues.listLabelsOnIssue to fetch the labels instead, it does not.

Minimal sufficient set: contents: read.

Expected behavior

The `permissions:` block lists only the scopes a step actually uses. Here that is
`contents: read`, for `actions/checkout`.

Actual behavior

pull-requests: read is also granted, and nothing consumes it. The script reads the labels out of context.payload, which is the webhook payload the runner already holds — no REST call is made, so no permission authorises it. The scope would only be needed if the labels were fetched through the API instead.

Suggested change:

 permissions:
   contents: read
-  pull-requests: read

Error details

Environment data

N/A

Visuals

No response