From 21588ba1edac33f3fb4801f13c8d36b72e2c8655 Mon Sep 17 00:00:00 2001
From: Yuan Teoh <yuanteoh@google.com>
Date: Mon, 13 Jul 2026 09:34:51 -0700
Subject: [PATCH] chore(ci): move write permission to job

---
 .github/workflows/export_cloud_build_logs.yml | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/export_cloud_build_logs.yml b/.github/workflows/export_cloud_build_logs.yml
index 35cf80d25..dfb9d9778 100644
--- a/.github/workflows/export_cloud_build_logs.yml
+++ b/.github/workflows/export_cloud_build_logs.yml
@@ -16,8 +16,6 @@ name: Export Cloud Build Failure Logs
 permissions: 
   contents: read
   checks: read
-  issues: write 
-  pull-requests: write 
 
 on:
   check_suite:
@@ -150,6 +148,9 @@ jobs:
   post-pr-comment:
     needs: [detect-build-failure, process-failed-builds]
     runs-on: ubuntu-latest
+    permissions:
+      issues: write 
+      pull-requests: write 
     if: always()
     steps:
       - name: Compose and post PR comment with artifact links