PR Summary

Fixes #28194.

Verify PR Labels declares pull-requests: read, but no step in the workflow needs it. The only steps are:

• actions/checkout, which requires contents: read.
• actions/github-script, whose inline script makes no API call. It reads context.payload.pull_request.labels, which is already part of the webhook payload the runner received. Reading it does not touch the REST API, so no permission authorises anything.

pull-requests: read would only be required if the script fetched the labels through the API instead, for example pulls.get or issues.listLabelsOnIssue. It does not, so contents: read is the minimal sufficient set.

PR Context

Removing the scope keeps the workflow working and reduces the token permissions granted to the job, in line with the principle of least privilege. The token minted for this workflow is available to every step, including the third-party actions pinned in it.

PR Checklist

• PR has a meaningful title
• Summarized changes
• Make sure all .h, .cpp, .cs, .ps1 and .psm1 files have the correct copyright header
• This PR is ready to merge.
• Breaking changes
  • None
• User-facing changes
  • Not Applicable
• Testing - New and feature
  • N/A or can only be tested interactively

Validation

The change only removes a permission that is not consumed. The verify-labels job is guarded by if: github.repository_owner == 'PowerShell', so it does not run on forks; on the upstream repository it continues to evaluate context.payload.pull_request.labels exactly as before, and actions/checkout keeps the contents: read it needs.