Fix: Grant required permissions for assign-to-agent GraphQL mutation

[Copilot]

The assign-to-agent safe output fails with "Resource not accessible by personal access token" because the compiler grants insufficient permissions for the replaceActorsForAssignable GraphQL mutation.

Root Cause

The compiler uses NewPermissionsContentsReadIssuesWrite() for assign-to-agent operations, but the GraphQL mutation requires elevated permissions on four scopes.

Changes

Compiler permissions (pkg/workflow/compiler_safe_outputs_job.go:260)

• Changed: NewPermissionsContentsReadIssuesWrite() → NewPermissionsActionsWriteContentsWriteIssuesWritePRWrite()
• Grants: actions: write, contents: write, issues: write, pull-requests: write

Affected workflows (auto-recompiled)

• issue-monster.lock.yml - Primary workflow using assign-to-agent
• workflow-generator.lock.yml - Also uses assign-to-agent

Example

Before:

safe_outputs:
  permissions:
    contents: read
    issues: write

After:

safe_outputs:
  permissions:
    actions: write
    contents: write
    issues: write
    pull-requests: write

Impact

All workflows using assign-to-agent safe output now receive correct permissions. The GraphQL mutation requires these elevated permissions per assign_agent_helpers.cjs:logPermissionError().

Original prompt

---

This section details on the original issue you should resolve

<issue_title>[agentics] Issue Monster failed</issue_title>
<issue_description>### Workflow Failure

Workflow: Issue Monster
Branch: main
Run URL: https://github.com/githubnext/gh-aw/actions/runs/21240454588

⚠️ Agent Assignment Failed: Failed to assign agent to issues due to insufficient permissions or missing token.

Assignment Errors:

• Issue [plan] Implement learnings persistence in Ralph Loop workflow #11137 (agent: copilot): Failed to assign copilot via GraphQL
• Issue [CI Failure Doctor] CI Failure Investigation - Massive Parallel Job Failures (Run #21238699729) #11207 (agent: copilot): Failed to assign copilot via GraphQL
• Issue [plan] Add PRD generation workflow for Ralph Loop #11136 (agent: copilot): Failed to assign copilot via GraphQL

Action Required

Debug this workflow failure using the agentic-workflows agent:

/agent agentic-workflows

When prompted, instruct the agent to debug this workflow failure.

Generated from Issue Monster

• expires on Jan 29, 2026, 7:57 AM UTC

Comments on the Issue (you are @copilot in this section)

• Fixes [agentics] Issue Monster failed #11229

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.