fix workflow permissions

.github/workflows/publish-packages.yml

@@ -7,6 +7,7 @@ concurrency:
 permissions:
   packages: write
   contents: write
+  pull-requests: write
 
 on:
   push:

.github/workflows/reusable-bump-version.yml

@@ -32,6 +32,12 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v3
 
+      - name: Define default branch
+        run: |
+          if [[ "${{ github.event_name }}" == "pull_request" ]]; then
+            echo "DEFAULT_BRANCH=${{ github.head_ref }}" >> $GITHUB_ENV
+          fi
+
       - name: Bump version and push tag
         id: bump
         uses: anothrNick/[email protected]

.github/workflows/reusable-carvel-publish-repo.yml

@@ -114,15 +114,18 @@ jobs:
 
       - name: Create pull request
         id: pr
-        if: inputs.prepare_repo_pr
         run: |
-          COMMIT_MESSAGE="$(git log --pretty=format:'%s' HEAD~..HEAD)"
+          if [[ "${{ github.event_name }}" == "pull_request" ]]; then
+            echo "PULL_REQUEST_NUMBER=${{ github.event.number }}" >> $GITHUB_OUTPUT
+          elif [[ "${{ inputs.prepare_repo_pr }}" =~ ^[tT][rR][uU][eE]$ ]]; then
+            COMMIT_MESSAGE="$(git log --pretty=format:'%s' HEAD~..HEAD)"
 
-          # create the pull request against CURRENT_BRANCH
-          gh pr create --base ${CURRENT_BRANCH} --title "Carvel repository release at commit ${{ github.sha }}" --body "${COMMIT_MESSAGE}"
+            # create the pull request against CURRENT_BRANCH
+            gh pr create --base ${CURRENT_BRANCH} --title "Carvel repository release at commit ${{ github.sha }}" --body "${COMMIT_MESSAGE}"
 
-          # get pull request number
-          echo "PULL_REQUEST_NUMBER=$(gh pr view --json number -q '.number' ${REPO_BRANCH_NAME})" >> $GITHUB_OUTPUT
+            # get pull request number
+            echo "PULL_REQUEST_NUMBER=$(gh pr view --json number -q '.number' ${REPO_BRANCH_NAME})" >> $GITHUB_OUTPUT
+          fi
         env:
           GH_TOKEN: ${{ github.token }}
 

.github/workflows/reusable-carvel-test.yml

@@ -141,7 +141,7 @@ jobs:
           if [[ "$PRERELEASE" =~ ^[tT][rR][uU][eE]$ ]]; then
             if [ -x ${SCRIPT} ]; then
               ${SCRIPT}
-            else
+            elif [ ! -z "$PULL_REQUEST_NUMBER" ]; then
               # no pre-release test script provided
               LABEL=untested
               gh label create -c ffaa00 --force $LABEL