Fix PR classifier label permissions

[Michelle Clayton (michelle-clayton-work)]

Summary

• grant the classifier caller and deterministic job pull-requests: write
• pin both reusable classifier jobs to the corresponding go-infra fix commit
• convert manual-dispatch PR numbers to the numeric reusable-workflow input type

GitHub authorizes adding a label to a pull request through the pull-requests permission, even though the REST route is /issues/{number}/labels. Production run https://github.com/microsoft/agent-framework-go/actions/runs/31719034436 had Issues: write but only PullRequests: read, so every label POST returned 403 Resource not accessible by integration.

The first validation dispatch also exposed that the caller's logical-OR expression converted the numeric dispatch input into an invalid reusable-workflow value. fromJSON(github.event.inputs.pr-number) preserves the required number type.

Depends on microsoft/go-infra#545.

Validation

• actionlint passes for .github/workflows/classify-pull-request.yml
• workflow-dispatch run https://github.com/microsoft/agent-framework-go/actions/runs/31733681923 passed deterministic classification, activation, agent execution, threat detection, safe outputs, and conclusion
• the deterministic job received PullRequests: write and applied size:medium plus area:agent to PR [dotnet-port-fixes] Bound tool approval auto-approval loop #835
• the semantic stage added kind:code and kind:tests

Bootstrap check

The automatic classifier check on this PR is expected to reproduce the existing 403 until this caller fix reaches main: pull_request_target always loads the workflow definition from the default branch rather than from the pull request. The branch-based workflow_dispatch validation above exercised this exact diff and passed end to end.

[Copilot]

Pull request overview

Updates the pull-request classification workflow to correctly apply labels by granting the required pull-requests: write permission, and aligns workflow-dispatch PR number handling with reusable workflow numeric input expectations.

Changes:

• Grant pull-requests: write at both workflow and reusable-workflow job levels to allow label application.
• Pin both reusable classifier workflows to the referenced go-infra fix commit.
• Ensure workflow-dispatch pr-number is passed as a number via fromJSON(github.event.inputs.pr-number || '0'), and adjust the dispatch guard to compare against '0'.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.