Request PR read access for no-fallback branch pushes

pkg/workflow/push_to_pull_request_branch_test.go

@@ -224,6 +224,10 @@ safe-outputs:
 	}
 
 	lockContentStr := string(lockContent)
+	safeOutputsJobSection := extractJobSection(lockContentStr, "safe_outputs")
+	if safeOutputsJobSection == "" {
+		t.Fatalf("Could not find safe_outputs job in lock file")
+	}
 	pushConfig := extractPushToPullRequestBranchHandlerConfig(t, lockContent)
 	fallbackAsPullRequest, exists := pushConfig["fallback_as_pull_request"]
 	if !exists {
@@ -236,9 +240,12 @@ safe-outputs:
 	if fallbackAsPullRequestBool {
 		t.Errorf("Expected fallback_as_pull_request=false, got %#v", fallbackAsPullRequestBool)
 	}
-	if strings.Contains(lockContentStr, "pull-requests: write") {
+	if strings.Contains(safeOutputsJobSection, "pull-requests: write") {
 		t.Errorf("Generated workflow should NOT have pull-requests: write permission when fallback-as-pull-request is false")
 	}
+	if !strings.Contains(safeOutputsJobSection, "pull-requests: read") {
+		t.Errorf("Generated workflow should have pull-requests: read permission when fallback-as-pull-request is false")
+	}
 }
 
 func TestPushToPullRequestBranchSignedCommitsDisabled(t *testing.T) {

pkg/workflow/safe_output_handlers.go

@@ -505,6 +505,7 @@ var safeOutputHandlers = []safeOutputHandlerDescriptor{
 				permissions.Merge(NewPermissionsContentsWritePRWrite())
 			} else {
 				permissions.Merge(NewPermissionsContentsWrite())
+				permissions.Set(PermissionPullRequests, PermissionRead)
 			}
 			if safeOutputs.PushToPullRequestBranch.AllowWorkflows {
 				permissions.Set(PermissionWorkflows, PermissionWrite)

pkg/workflow/safe_outputs_permissions_test.go

@@ -331,7 +331,7 @@ func TestComputePermissionsForSafeOutputs(t *testing.T) {
 			},
 		},
 		{
-			name: "push-to-pull-request-branch with fallback-as-pull-request false - no pull-requests permission but administration read",
+			name: "push-to-pull-request-branch with fallback-as-pull-request false - requires pull-requests read and administration read",
 			safeOutputs: &SafeOutputsConfig{
 				PushToPullRequestBranch: &PushToPullRequestBranchConfig{
 					BaseSafeOutputConfig:  BaseSafeOutputConfig{},
@@ -340,6 +340,7 @@ func TestComputePermissionsForSafeOutputs(t *testing.T) {
 			},
 			expected: map[PermissionScope]PermissionLevel{
 				PermissionContents:       PermissionWrite,
+				PermissionPullRequests:   PermissionRead,
 				PermissionAdministration: PermissionRead,
 			},
 		},