Does secrets.GITHUB_TOKEN have permissions to request reviewers?

[harupy]

I have a workflow that looks like below. It fails with 403 (Resource not accessible by integration). Does secrets.GITHUB_TOKEN have permissions to request reviewers?

https://github.com/mlflow/mlflow/actions/runs/9773367071/job/26979393635

# Does this work?

name: Review

on:
  pull_request:
    types: [review_requested]

jobs:
  review:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/github-script@v7
        with:
          script: |
            const { owner, repo } = context.repo;
            const pull_number = context.payload.pull_request.number;
            await github.rest.pulls.requestReviewers({
              owner,
              repo,
              pull_number,
              reviewers: ["foo", "bar"],
            });

[harupy]

Added the following and it worked:

    permissions:
      pull-requests: write

[harupy]

It turns out our repo uses Read repository contents and packages permissions. pull-requests: write is required.