From eae000bd624df8318a46b91a624634ba5166af84 Mon Sep 17 00:00:00 2001
From: codex-bot-andresmgsl
 <304681515+codex-bot-andresmgsl@users.noreply.github.com>
Date: Fri, 24 Jul 2026 22:57:22 +0000
Subject: [PATCH] docs: add actions read to private caller guidance

---
 actions/labels-reconcile/labels-reconcile.sh | 4 ++--
 changelog.d/173.md                           | 1 +
 docs/CONSUMERS.md                            | 3 ++-
 test/labels-reconcile.test.sh                | 2 +-
 4 files changed, 6 insertions(+), 4 deletions(-)
 create mode 100644 changelog.d/173.md

diff --git a/actions/labels-reconcile/labels-reconcile.sh b/actions/labels-reconcile/labels-reconcile.sh
index 30ec354..4d1ddc0 100755
--- a/actions/labels-reconcile/labels-reconcile.sh
+++ b/actions/labels-reconcile/labels-reconcile.sh
@@ -70,9 +70,9 @@ blind_sweep_warning() { # $1 = unreadable PRs, $2 = all open PRs, $3 = sampled r
   if [ "$2" -gt 0 ] && [ "$1" -eq "$2" ]; then
     local reason="${3:-}"
     if [ -n "$reason" ]; then
-      echo "::warning::labels: every open PR was unreadable; sampled reason: $reason — one candidate is missing checks: read and statuses: read in the caller (private repos do not imply them)"
+      echo "::warning::labels: every open PR was unreadable; sampled reason: $reason — one candidate is missing checks: read, statuses: read and actions: read in the caller (private repos do not imply them)"
     else
-      echo "::warning::labels: every open PR was unreadable; no reason was captured — one candidate is missing checks: read and statuses: read in the caller (private repos do not imply them)"
+      echo "::warning::labels: every open PR was unreadable; no reason was captured — one candidate is missing checks: read, statuses: read and actions: read in the caller (private repos do not imply them)"
     fi
   fi
 }
diff --git a/changelog.d/173.md b/changelog.d/173.md
new file mode 100644
index 0000000..7874a93
--- /dev/null
+++ b/changelog.d/173.md
@@ -0,0 +1 @@
+- Private-repository label callers document `actions: read` alongside checks and statuses for workflow-run check-rollup nodes (#173).
diff --git a/docs/CONSUMERS.md b/docs/CONSUMERS.md
index 9d8ac06..da11abd 100644
--- a/docs/CONSUMERS.md
+++ b/docs/CONSUMERS.md
@@ -314,6 +314,7 @@ permissions:
   contents: read
   checks: read          # mergeability/check-rollup read for PR state
   statuses: read        # commit-status rollup read for PR state
+  actions: read         # workflow-run nodes inside the check rollup — private repos do not imply it (incubator#60)
   issues: write
   pull-requests: write
 jobs:
@@ -323,7 +324,7 @@ jobs:
 
 Naming any permission sets every unnamed permission to `none`. Public
 repositories allow check data to be read regardless, but a private consumer
-needs both explicit reads above; without them the failure appears as an empty
+needs all three explicit reads above; without them the failure appears as an empty
 `state:*` axis on the board rather than a red workflow run.
 
 The `issues:` trigger is available at `0.2.0` and later — `0.2.0` is the
diff --git a/test/labels-reconcile.test.sh b/test/labels-reconcile.test.sh
index 6e7e02d..2c41628 100755
--- a/test/labels-reconcile.test.sh
+++ b/test/labels-reconcile.test.sh
@@ -41,7 +41,7 @@ reviews() { jq -s '.' <<<"$*"; } # collect review objects into an array
 # -- a sweep-wide read failure is visible without changing any PR ------------
 warning="$(blind_sweep_warning 3 3 "HTTP 403: Resource not accessible by integration")"
 expect "a wholly blind sweep warns, leading with the observed reason" \
-  "::warning::labels: every open PR was unreadable; sampled reason: HTTP 403: Resource not accessible by integration — one candidate is missing checks: read and statuses: read in the caller (private repos do not imply them)" \
+  "::warning::labels: every open PR was unreadable; sampled reason: HTTP 403: Resource not accessible by integration — one candidate is missing checks: read, statuses: read and actions: read in the caller (private repos do not imply them)" \
   "$warning"
 expect "the blind warning names checks: read" named \
   "$(grep -qF "checks: read" <<<"$warning" && echo named || echo missing)"