@david_chisnall I think I'm lacking a ton of context, but in my previous workplace we had GitHub Actions interacting with the GitHub APIs- so you could schedule ticket/PR creation and that kind of stuff, and the security model looked... somewhat reasonable from an uninformed POV? (You can request the GH Actions token to have more permissions than the default.)
Not sure what's the issue, but I don't see more responses...
PRs by default run with restricted permissions and you can’t let them have more. But you can give them a PAT that is in the secrets. Except that PRs don’t have access to secrets by default for very good reasons (though you can change that policy).
@david_chisnall ah, yes, I was working on private repos so we didn't consider PR permissions a big problem.
Maybe you can run a workflow on a schedule from the main branch. It's not ideal, of course.
