From 430ad4e194604ffb1583e4357d306ae7678c869e Mon Sep 17 00:00:00 2001
From: andig <andi@evcc.io>
Date: Mon, 13 Jul 2026 17:48:05 +0200
Subject: [PATCH] CI: fix /analyze command startup failure (#31762)

---
 .github/workflows/claude-issue-agent-run.yml | 10 ++--------
 1 file changed, 2 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/claude-issue-agent-run.yml b/.github/workflows/claude-issue-agent-run.yml
index 4ac462d75..2cbe7a855 100644
--- a/.github/workflows/claude-issue-agent-run.yml
+++ b/.github/workflows/claude-issue-agent-run.yml
@@ -30,14 +30,8 @@ jobs:
   run:
     name: Issue agent
     runs-on: ubuntu-latest
-    # Superset of what either mode needs; the caller job scopes the token down
-    # (analyze grants only contents: read, so it cannot push or open PRs).
-    permissions:
-      contents: write
-      issues: write
-      pull-requests: write
-      id-token: write
-      actions: read
+    # No permissions block: inherit the caller's grant (triage=write to push
+    # fixes, analyze=read). A reusable job can only reduce, never elevate.
     steps:
       - name: Checkout repository
         uses: actions/checkout@v7