fix: grant contents/pull-requests write to sync_actions reusable workflow call

[Copilot]

The sync_actions job calls sync-actions.yml@main, which internally declares contents: write, pull-requests: write. The compiler always emits permissions: {} at the workflow top-level, so without explicit job-level permissions on the calling job, the reusable workflow is denied those permissions.

Changes

• release.md: Added permissions: contents: write, pull-requests: write to the sync_actions job definition
• release.lock.yml: Recompiled — permissions now appear on the sync_actions job

sync_actions:
  needs: ["pre_activation", "activation", "config", "push_tag"]
  uses: github/gh-aw-actions/.github/workflows/sync-actions.yml@main
  with:
    ref: ${{ needs.config.outputs.release_tag }}
  secrets: inherit
  permissions:
    contents: write
    pull-requests: write

[Copilot]

Pull request overview

This PR fixes a permissions denial when the sync_actions job calls a reusable workflow (sync-actions.yml@main) that requires elevated token scopes.

Changes:

• Adds explicit job-level permissions (contents: write, pull-requests: write) to sync_actions in the source workflow markdown.
• Recompiles the generated workflow so the permissions block is present in the sync_actions job in the lockfile.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
.github/workflows/release.md	Grants sync_actions the job-level write permissions required by the called reusable workflow.
.github/workflows/release.lock.yml	Regenerated output reflects the new sync_actions job permissions block.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.