it seems I can't request the WRITE for issues/pullrequests from our workflow permissions:

GITHUB_TOKEN Permissions
  Actions: read
  Attestations: read
  Checks: read
  Contents: read
  Deployments: read
  Discussions: read
  Issues: read
  Metadata: read
  Packages: read
  Pages: read
  PullRequests: read
  RepositoryProjects: read
  SecurityEvents: read
  Statuses: read

even when I request "write-all".
see https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions

is there a repo/org setting that we need to tweak for this?
edit: seems there's a policy for this

https://docs.github.com/en/enterprise-cloud@latest/admin/enforcing-policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-workflow-permissions-in-your-enterprise

It sounds to me like it's a similar issue from the discussion from this comment https://github.com/etcd-io/website/pull/845#issuecomment-2168851307https://github.com/etcd-io/website/pull/845#issuecomment-2168851307.

James suggested setting the org-level permissions could be a dead end in that case. In that case, maybe the only option would be to do it through a prow plugin, but the investment to build it is bigger.

@jmhbnz can we raise this again with the right people? It seems a bit ridiculous to not have this set on an org level...

@jmhbnz can we raise this again with the right people? It seems a bit ridiculous to not have this set on an org level...

Raised discussion with k8s #github-management here: https://kubernetes.slack.com/archives/C01672LSZL0/p1719825480464109

I wonder if we're missing something, as it seems like our measure-testgrid-flakiness can create new issues(?)

Refer to: https://github.com/etcd-io/etcd/blob/1bff41630e5ccfab638d01f55e3636c22c4bc36f/.github/workflows/measure-testgrid-flakiness.yaml

Otherwise, based on the response from #github-management, it seems like we hit a dead end.

The existing behavior is already good enough: the benchmark workflow will fail if there is any unexpected performance reduce. We don't have to necessarily spend too much effort to automatically add a comment.

let's close, we can dig this up with Prow once more