Hi, team.

When I run "gh edit pr --add-label" using the GitHub application token, I got an error message saying I need project permissions.

The code to reproduce this situation is as follows.

Reproduction method

GitHub Application

GitHub application has permissions...

• Read access to metadata
• Read and write access to pull requests

GitHub Actions

  : <snip>
jobs:
  add-label:
    runs-on: ubuntu-latest
    steps:
      - name: Generate github token
        id: generate_token
        uses: tibdex/github-app-token@v1
        with:
          # secrets.APP_ID and secrets.PRIVATE_KEY are set to the ID and private key of the GitHub application.
          app_id: ${{ secrets.APP_ID }}
          private_key: ${{ secrets.PRIVATE_KEY }}
      # env.PR_URL is set to the URL of pull request
      - run: gh pr edit --add-label "label1" ${{ env.PR_URL }}
        env:
          GITHUB_TOKEN: ${{ steps.generate_token.outputs.token }}

Error messages

GraphQL: Resource not accessible by integration (repository.pullRequest.projectCards.nodes)

Solution

I added project read permissions as the message suggested, and was able to edit the pull request and add labels.

Question

However, GitHub REST API v3 only says that editing a pull request requires write permission to the pull request.
(https://docs.github.com/en/rest/overview/permissions-required-for-github-apps#permission-on-pull-requests)

Why does "gh pr edit --add-label" require read permission to the project?

By the way, in the public repository, "gh pr edit --add-label" does not require project read permission.

Thank you very much.