Enable github actions can create pull requests

[marco-ippolito]

I noticed that after the transition to enterprise org, the ability for github actions to create PR has been revoked.
On amaro it fails:

If I try to change at repo level the checkbox is disabled.

I think this has to be changed at organization level https://github.com/enterprises/nodejs/settings/actions

ping @nodejs/tsc

[legendecas]

Would you mind trying the following settings in the github action yaml (doc)?:

jobs:
  stale:
    runs-on: ubuntu-latest

    permissions:
      issues: write
      pull-requests: write

    steps:
      - uses: actions/stale@v5

[legendecas]

Related change: nodejs/snap#69

[marco-ippolito]

I already enabled those, but still fails https://github.com/nodejs/amaro/blob/b4585eaa90a8c4797096e666d1ba44c4d703f3a1/.github/workflows/update-swc.yml#L16-L21

[aduh95]

Alternatively, we could decide write permission is only possible via the bot's account, now that we have a process for it – but that'd be quite a disruptive change, maybe it's more reasonable to simply allow Read and Write permissions for the usual GITHUB_TOKEN.

[legendecas]

I found the doc: https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests. It is an additional checkbox setting from the default "read" permission.

I think in amaro's case, in order to run test actions on each update pull request as well, you'll need a bot account's token. So I would suggest the process as documented here.

[marco-ippolito]

Fixed #905 (comment)