From efde2dcdd92f11da290c1b6dd50cc18f0cd38294 Mon Sep 17 00:00:00 2001
From: Jon Ross-Perkins <jperkins@google.com>
Date: Fri, 12 Aug 2022 11:42:51 -0700
Subject: [PATCH] Switch token approach (#2013)

According to this run, the attempt to get write permissions failed:
https://github.com/carbon-language/carbon-lang/runs/7811743119?check_suite_focus=true

So I'm switching to an org secret, which I believe I can definitely make work.
---
 .github/workflows/proposal_labeled.yaml | 13 +++++--------
 .github/workflows/proposal_ready.yaml   |  5 +----
 2 files changed, 6 insertions(+), 12 deletions(-)

diff --git a/.github/workflows/proposal_labeled.yaml b/.github/workflows/proposal_labeled.yaml
index 5298444eeb88..60ede99b5ddd 100644
--- a/.github/workflows/proposal_labeled.yaml
+++ b/.github/workflows/proposal_labeled.yaml
@@ -19,9 +19,6 @@ on:
     types:
       - labeled
 
-permissions:
-  pull-requests: write
-
 jobs:
   proposal_labeled:
     runs-on: ubuntu-latest
@@ -37,7 +34,7 @@ jobs:
             --remove-label "proposal deferred" \
             --add-label "proposal"
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.LABEL_ACTION_GITHUB }}
           PR: ${{ github.event.pull_request.html_url }}
 
       - name: rfc
@@ -51,7 +48,7 @@ jobs:
             --remove-label "proposal deferred" \
             --add-label "proposal"
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.LABEL_ACTION_GITHUB }}
           PR: ${{ github.event.pull_request.html_url }}
 
       - name: accepted
@@ -65,7 +62,7 @@ jobs:
             --remove-label "proposal deferred" \
             --add-label "proposal"
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.LABEL_ACTION_GITHUB }}
           PR: ${{ github.event.pull_request.html_url }}
 
       - name: declined
@@ -79,7 +76,7 @@ jobs:
             --remove-label "proposal deferred" \
             --add-label "proposal"
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.LABEL_ACTION_GITHUB }}
           PR: ${{ github.event.pull_request.html_url }}
 
       - name: deferred
@@ -93,5 +90,5 @@ jobs:
             --remove-label "proposal declined" \
             --add-label "proposal"
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.LABEL_ACTION_GITHUB }}
           PR: ${{ github.event.pull_request.html_url }}
diff --git a/.github/workflows/proposal_ready.yaml b/.github/workflows/proposal_ready.yaml
index c4a1332d3851..d501b9518b21 100644
--- a/.github/workflows/proposal_ready.yaml
+++ b/.github/workflows/proposal_ready.yaml
@@ -10,9 +10,6 @@ on:
     types:
       - ready_for_review
 
-permissions:
-  pull-requests: write
-
 jobs:
   proposal_ready:
     if: contains(github.event.pull_request.labels.*.name, 'proposal')
@@ -27,5 +24,5 @@ jobs:
             --remove-label "proposal deferred" \
             --add-label "proposal rfc"
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.LABEL_ACTION_GITHUB }}
           PR: ${{ github.event.pull_request.html_url }}