Grant the auto-merge caller the reusable gate's read scopes

.github/workflows/auto-merge-prs.yml

@@ -55,9 +55,15 @@ on:
   pull_request:
     types: [opened, synchronize, reopened, labeled, ready_for_review, unlabeled]
 
+# checks/actions/issues reads feed the reusable's in-flight gate (a called
+# workflow's GITHUB_TOKEN is capped by the caller's grants, and a called
+# workflow requesting scopes the caller omits fails at startup).
 permissions:
   contents: write
   pull-requests: write
+  checks: read
+  actions: read
+  issues: read
 
 jobs:
   auto-merge:

test/branch-protection-gate.test.ts

@@ -265,6 +265,22 @@ describe("required contexts are not renamed out from under the ruleset", () => {
     expect(auto).not.toMatch(/fetch-depth:\s*0/);
     const gate = readFileSync(join(repoRoot, "scripts", "pr-touches-codeowners-paths.sh"), "utf8");
     expect(gate).toContain("CODEOWNERS");
+
+    // The reusable's in-flight gate looks up the head commit's check runs and the head
+    // branch's queued workflow runs.  A called workflow cannot elevate the caller's token:
+    // it fails at startup with "The workflow is requesting 'checks: read', but is only
+    // allowed 'checks: none'" when the caller omits a scope.  No job in this workflow
+    // declares its own permissions block, so the workflow-level block below is the
+    // effective one and these lines are the whole contract.  A later edit that drops one
+    // of them breaks arming for every pull request in this repo, so assert them here
+    // rather than trusting the grant to stay put (Kody review, PR #4908).
+    const callerPermissions =
+      withoutComments(auto).match(/^permissions:\n((?:[ \t]+\S+: \S+\n)+)/m)?.[1] ?? "";
+    expect(callerPermissions).toMatch(/^[ \t]+contents: write$/m);
+    expect(callerPermissions).toMatch(/^[ \t]+pull-requests: write$/m);
+    expect(callerPermissions).toMatch(/^[ \t]+checks: read$/m);
+    expect(callerPermissions).toMatch(/^[ \t]+actions: read$/m);
+    expect(callerPermissions).toMatch(/^[ \t]+issues: read$/m);
   });
 
   it("does not ask the armer to delete the branch while the merge queue is on", () => {