From b309c018f0b94b24ffeda455725c54f610d7b5e4 Mon Sep 17 00:00:00 2001
From: Otto-AGPT <otto@agpt.co>
Date: Fri, 6 Feb 2026 19:32:07 +0000
Subject: [PATCH] fix: add statuses:read permission for commit status API

Required to read CLA check status via repos.getCombinedStatusForRef().
pull-requests:write does not include statuses:read per GitHub docs.
---
 .github/workflows/cla-label-sync.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/cla-label-sync.yml b/.github/workflows/cla-label-sync.yml
index c9d56ab5ae..b8603eccd0 100644
--- a/.github/workflows/cla-label-sync.yml
+++ b/.github/workflows/cla-label-sync.yml
@@ -23,6 +23,7 @@ on:
 permissions:
   pull-requests: write
   contents: read
+  statuses: read
 
 env:
   CLA_CHECK_NAME: 'license/cla'