The assign-to-agent safe output fails with "Resource not accessible by personal access token" because the compiler grants insufficient permissions for the replaceActorsForAssignable GraphQL mutation.

Root Cause

The compiler uses NewPermissionsContentsReadIssuesWrite() for assign-to-agent operations, but the GraphQL mutation requires elevated permissions on four scopes.

Changes

Compiler permissions (pkg/workflow/compiler_safe_outputs_job.go:260)

• Changed: NewPermissionsContentsReadIssuesWrite() → NewPermissionsActionsWriteContentsWriteIssuesWritePRWrite()
• Grants: actions: write, contents: write, issues: write, pull-requests: write

Affected workflows (auto-recompiled)

• issue-monster.lock.yml - Primary workflow using assign-to-agent
• workflow-generator.lock.yml - Also uses assign-to-agent

Example

Before:

safe_outputs:
  permissions:
    contents: read
    issues: write

After:

safe_outputs:
  permissions:
    actions: write
    contents: write
    issues: write
    pull-requests: write

Impact

All workflows using assign-to-agent safe output now receive correct permissions. The GraphQL mutation requires these elevated permissions per assign_agent_helpers.cjs:logPermissionError().

• Fixes [agentics] Issue Monster failed #11229

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.