From 41d9ef535b1a4b7af6bc880db863c69172dc6d44 Mon Sep 17 00:00:00 2001
From: rahim <rahim.alwer@gmail.com>
Date: Sat, 28 Feb 2026 22:07:32 -0800
Subject: [PATCH] fix(ci): reduce issue sync permission denials (#662)

---
 .github/workflows/issue-sync.yml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/.github/workflows/issue-sync.yml b/.github/workflows/issue-sync.yml
index 9cf49a38..5ab58a88 100644
--- a/.github/workflows/issue-sync.yml
+++ b/.github/workflows/issue-sync.yml
@@ -5,6 +5,7 @@ on:
     types: [closed]
 
 permissions:
+  actions: read
   contents: read
   pull-requests: read
   issues: write
@@ -29,9 +30,11 @@ jobs:
         uses: anthropics/claude-code-action@v1
         with:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
+          github_token: ${{ secrets.GITHUB_TOKEN }}
           claude_args: |
             --model sonnet
             --max-turns 12
+            --allowedTools "Bash(gh:*)" "WebSearch" "WebFetch"
           prompt: |
             A pull request was merged and you are the issue follow-up agent.
 
@@ -40,6 +43,8 @@ jobs:
             - Title: ${{ github.event.pull_request.title }}
             - URL: ${{ github.event.pull_request.html_url }}
             - Merged by: ${{ github.event.pull_request.merged_by.login }}
+            - Body:
+              ${{ github.event.pull_request.body }}
 
             Tasks:
             1. Identify issues this PR references or could reasonably affect.