[Code Quality] Fix campaign label permissions for update_project handler

[github-actions]

Description

The safe output update_project handler is failing to add campaign labels to issues due to insufficient GitHub token permissions. This results in warnings appearing in workflow logs and affects issue organization and campaign tracking.

Current Issue

Warning message appearing in logs:

##[warning]Failed to add campaign label: Resource not accessible by personal access token

Root Cause:
The GitHub personal access token lacks the necessary permissions to add labels to issues. The update_project handler attempts to add campaign labels as part of project updates, but this operation fails silently with a warning.

Impact

• Campaign labels are not being added to issues during project updates
• Issue organization and campaign tracking is incomplete
• Safe output processing continues successfully (non-blocking warning)
• Affects the Security Alert Burndown workflow and similar workflows

Suggested Solutions

Option A: Update Token Permissions (Recommended)

Update the workflow permissions to include label management:

permissions:
  issues: write
  projects: write
  contents: read

Option B: Graceful Degradation

Modify the safe output handler to catch permission errors gracefully:

try {
  await addCampaignLabel(issue);
} catch (error) {
  if (error.message.includes('Resource not accessible')) {
    core.info('Skipping campaign label - insufficient permissions');
  } else {
    throw error;
  }
}

Files Affected

• Workflow YAML files using update_project safe output (e.g., Security Alert Burndown)
• OR: pkg/workflow/js/safe_outputs_handlers.cjs (if implementing graceful degradation)

Success Criteria

• Campaign labels are successfully added to issues during project updates
• OR: Handler gracefully skips label addition with informative logging
• No warnings appear in safe output job logs for label operations
• Project updates continue to succeed regardless of label operation outcome

Affected Workflows

• Security Alert Burndown (workflow_dispatch event)
• Any workflow using update_project safe output that needs campaign labels

Source

Extracted from Safe Output Health Report discussion #12131

Priority

Medium - Prevents proper campaign tracking but doesn't block workflow execution.

Affected Run

• §21416210134 - Security Alert Burndown

AI generated by Discussion Task Miner - Code Quality Improvement Agent

• expires on Feb 11, 2026, 5:10 AM UTC

[github-actions]

🍪 Issue Monster has assigned this to Copilot!

I've identified this issue as a good candidate for automated resolution and assigned it to the Copilot agent.

The Copilot agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

AI generated by Issue Monster