From bdbd313c0d03c49e2db850235853981aea4cb400 Mon Sep 17 00:00:00 2001
From: Lukasz Raczylo <lukasz@raczylo.com>
Date: Sat, 3 Oct 2026 20:17:52 +0100
Subject: [PATCH] fix(autoupdate): let Renovate read issues in a private repo

Renovate queries the repository issues when it starts. The job token had
no issues permission, so a private repo returned FORBIDDEN and Renovate
stopped with platform-unknown-error. Public repos expose issues, which hid
the problem. Grant issues: read to the Renovate job.
---
 .github/workflows/renovate-autoupdate.yaml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/renovate-autoupdate.yaml b/.github/workflows/renovate-autoupdate.yaml
index 0e67723..c7cb369 100644
--- a/.github/workflows/renovate-autoupdate.yaml
+++ b/.github/workflows/renovate-autoupdate.yaml
@@ -104,6 +104,8 @@ jobs:
     timeout-minutes: 45
     permissions:
       contents: write
+      # Renovate reads the repository's issues when it starts. A private repo refuses that without this.
+      issues: read
       pull-requests: write
     outputs:
       branches: ${{ steps.list.outputs.branches }}