fix: Label Large PR workflow failed for forked PRs (#265)

[Bakomebandias]

Adds pull-requests: write permission to the workflow, which should resolve the HTTP 403 error when adding/removing labels on PRs from forks.\n\nCloses #265.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: fa8b6d18-c80e-499d-a00c-63c490c0e5f7

📥 Commits

Reviewing files that changed from the base of the PR and between ab6ae16 and c0a2dc9.

📒 Files selected for processing (1)

• .github/workflows/large-pr-labeler.yml

💤 Files with no reviewable changes (1)

• .github/workflows/large-pr-labeler.yml

---

Walkthrough

This PR adds a workflow-level permissions block to .github/workflows/large-pr-labeler.yml granting pull-requests: write to the GITHUB_TOKEN (lines 7–10), enabling the workflow to apply the large-pr label. The workflow logic and PR labeling scripts remain unchanged.

Possibly related issues

• Help wanted: fix "Label Large PR" workflow failed for forked PRs #265: Directly addresses the permission denied error (Resource not accessible by integration) that this PR resolves by granting explicit pull-requests: write scope to the labeler workflow.

Possibly related PRs

• yarsa/nepal-compliance#267: Modifies the same workflow's permissions configuration for the large-pr labeling behavior.
• yarsa/nepal-compliance#259: Also adjusts explicit GitHub Actions permissions in the large-pr-labeler workflow to grant proper token scopes.
• yarsa/nepal-compliance#261: Updates the same workflow's top-level permissions block to grant required scopes for token-based operations.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately describes the main change: fixing the GitHub Actions workflow to enable labeling on forked PRs by adding the required permission.
Description check	✅ Passed	The description clearly relates to the changeset, explaining the addition of pull-requests: write permission and its purpose in resolving HTTP 403 errors on forked PRs.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: d0d3be9d-347b-4db5-acd9-d7cabb8cfc49

📥 Commits

Reviewing files that changed from the base of the PR and between 9e3c3fd and 59763ff.

📒 Files selected for processing (1)

• .github/workflows/large-pr-labeler.yml

[Bakomebandias]

Thank you @coderabbitai! I've fixed the YAML structure — permissions block is now correctly placed. Ready for re‑review.

[coderabbitai]

@Bakomebandias Solid work, boss! Like a proper hooks/doc_events registration — everything's gotta be in the right place in the hierarchy, or Frappe just ignores it entirely. Same deal with GitHub Actions YAML — the permissions block needs to sit at the top-level workflow scope (not nested inside a job or step) to have the right effect. Let me spin up a fresh review on the updated structure now.

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

Actionable comments posted: 1

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 07d9add7-c341-45ba-960c-ad119854fef5

📥 Commits

Reviewing files that changed from the base of the PR and between 59763ff and 7efb7d0.

📒 Files selected for processing (1)

• .github/workflows/large-pr-labeler.yml

[Bakomebandias]

Thank you @coderabbitai! I've removed the duplicate permissions block. The YAML should now be clean and valid.

[coderabbitai]

Tip

For best results, initiate chat on the files or code changes.

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
cat .github/workflows/large-pr-labeler.yml

Length of output: 2247

---

---

@Bakomebandias The permissions block is sitting clean at the top-level workflow scope now — exactly how Frappe expects hook registrations to be defined, in the right place in the hierarchy. ✅

However, there's still one stray issue lurking — a duplicate types key under the pull_request trigger (lines 4–5):

on:
  pull_request:
    types: [opened, synchronize, reopened]
    types: [opened, synchronize, reopened]   # ← duplicate, needs to go

In YAML, duplicate keys are technically invalid. Most parsers silently keep the last occurrence (so the workflow will likely still run), but it's messy and could confuse tooling or linters down the road. Just like having a duplicate frappe.whitelist() decorator on the same method — it won't always crash, but it signals something went wrong during a refactor.

Fix: Remove one of the duplicate types lines so the trigger block looks like:

on:
  pull_request:
    types: [opened, synchronize, reopened]

Once that's cleaned up, the file should be in solid shape and the PR is good to go! 🚀

[coderabbitai]

Actionable comments posted: 1

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 62281e80-0fc0-4442-b281-2ac2444fcd08

📥 Commits

Reviewing files that changed from the base of the PR and between 7efb7d0 and ab6ae16.

📒 Files selected for processing (1)

• .github/workflows/large-pr-labeler.yml

[Bakomebandias]

Friendly bump. This PR is mergeable and ready for review. Thank you.

[github-actions]

This PR has been automatically marked as stale because it has been open 30 days with no activity. Remove stale label or comment or this will be closed in 7 days.

[github-actions]

This pull request was closed automatically after being stale for 7 days.