From d07b76e9c70bfcc1e23ad29b1b533c3544e332c1 Mon Sep 17 00:00:00 2001
From: Ryan Melton <ryan@openc3.com>
Date: Mon, 28 Sep 2026 20:35:51 -0600
Subject: [PATCH] ci(ai-review): grant checks: read so reviewers see SonarQube
 findings

The shared AI review gate now reads the SonarQube check run on the PR
head (OpenC3/.github#14). A called workflow cannot exceed its caller's
permissions, so the caller must grant checks: read.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 .github/workflows/ai_review.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/ai_review.yml b/.github/workflows/ai_review.yml
index b1bdefce86..d057e9cd0c 100644
--- a/.github/workflows/ai_review.yml
+++ b/.github/workflows/ai_review.yml
@@ -80,6 +80,7 @@ jobs:
     uses: OpenC3/.github/.github/workflows/ai-review-reusable.yml@main
     permissions:
       actions: read
+      checks: read
       contents: read
       pull-requests: write
       statuses: read