ci-pr-health.yml failing daily: cleanup-labels gets 403 on PR labels (needs pull-requests: write)

[claude]

Symptom

.github/workflows/ci-pr-health.yml has failed on every run since at least 2026-04-22 (today is 2026-05-11). Each failure auto-files a fresh "System wellness check failing" ticket — recent: QUA-1119 (2026-05-10), #4544, #4542, #4491, #4477, #4469.

Root cause (likely)

In the PR & issue quality step, crux health check --cleanup-labels tries to remove the pr-patrol:working label from old PRs and gets:

WARN  #4880 — failed to remove label: GitHub API DELETE
/repos/quantified-uncertainty/longterm-wiki/issues/4880/labels/pr-patrol%3Aworking
returned 403: {"message":"Resource not accessible by integration", ...}

#4880 etc. are PRs. The workflow's permissions block currently grants:

permissions:
  issues: write
  actions: read
  pull-requests: read

GitHub's labels endpoint shares the /issues/{n}/labels/ path for both issues and PRs, but the GitHub Actions integration enforces pull-requests: write for label mutations on PRs. With pull-requests: read, the call returns 403 → the check exits 1 → the workflow fails → a new wellness ticket is filed.

Proposed fix

Change line 42 of .github/workflows/ci-pr-health.yml:

   permissions:
     issues: write
     actions: read
-    pull-requests: read
+    pull-requests: write

Why I'm filing instead of patching

The maintenance bot tried to push this fix and was rejected:

! [remote rejected] ... (refusing to allow a GitHub App to create or update
  workflow `.github/workflows/ci-pr-health.yml` without `workflows` permission)

The Claude Code GitHub App token lacks workflows scope, so a human (or a workflow with the right token) needs to apply this 1-line change. Same blocker would apply to any agent-authored workflow patch — worth noting for future maintenance sweeps.

Verification after the fix

Next scheduled run of ci-pr-health.yml (8:10 UTC twice daily). The WARN lines should disappear and the workflow should pass green. If still 403, the actual problem may be in the GitHub App's installation permissions rather than the workflow permissions block — escalate by checking the repo's GitHub Actions token permissions in repo settings.

Related

• QUA-1119 (today's auto-filed wellness ticket — symptom of this)
• e2e-post-deploy red streak: React hydration error #418 on org pages (4/5 runs failing) #4866 (separate: e2e-post-deploy red streak, React hydration Merge legacy /browse/ pages to /wiki equivalents #418 on org pages — unrelated to this)
• 5 closed "System wellness check failing" tickets in past month — all are symptoms of the same 403, autoclosed without fixing the root cause

[claude]

Daily maintenance audit (2026-05-15): still failing, no resolution.

• Last 10 runs: all failure (most recent: 25886335572 at 2026-05-14T21:19:59Z)
• Root cause unchanged: 403 Resource not accessible by integration when trying to DELETE /repos/.../issues/N/labels/pr-patrol%3Aworking. Workflow's GITHUB_TOKEN is granted PullRequests: read but needs pull-requests: write to remove labels.
• Side effect: each failed run creates a fresh Linear wellness ticket (e.g., QUA-1132 from yesterday's run). This is producing duplicate Linear tickets daily until the workflow is fixed.

Fix is a one-line edit to .github/workflows/ci-pr-health.yml to add pull-requests: write under permissions:.

[claude]

Maintenance sweep follow-up (2026-05-15): I attempted to ship the one-line fix (changing pull-requests: read → pull-requests: write in .github/workflows/ci-pr-health.yml), but the push was rejected by GitHub:

! [remote rejected]  refusing to allow a GitHub App to create or update workflow `.github/workflows/ci-pr-health.yml` without `workflows` permission

The claude[bot] App used by maintenance sessions does not have workflows permission, so workflow files cannot be modified from automated sweeps. This needs a human (or differently-permissioned bot) to merge.

The exact diff that needs to land:

     permissions:
       issues: write
       actions: read
-      pull-requests: read
+      pull-requests: write

(One line, only file: .github/workflows/ci-pr-health.yml)