fix: release drafter v7

[Timongcraft]

Overview

fix release-drafter v7 changing gh token usage

If you were using a specific access token using env.GITHUB_TOKEN: $MY_CUSTOM_TOKEN, migrate to the new token: input [...]
see release-drafter/release-drafter#1475

Submitter Checklist

• Make sure you are opening from a topic branch (/feature/fix/docs/ branch (right side)) and not your main branch.
• Ensure that the pull request title represents the desired changelog entry.
  - [ ] New public fields and methods are annotated with @since TODO.
• I read and followed the contribution guidelines.

[PierreSchwang]

Should work without, no?

Introduce the token input, replaces the (need for) GITHUB_TOKEN env variable. Defaults to ${{ github.token }}

[Timongcraft]

Yea, right...

So it seems like you need to set the permissions in the workflow maybe?
Because they need to be set on the token and other workflows seem to set a permission
e.g. https://github.com/open-telemetry/opentelemetry-erlang-contrib/blob/main/.github/workflows/release-drafter.yml#L14-L15
And the old token via environment might have circumvented that maybe?

Error: Resource not accessible by integration - https://docs.github.com/rest/releases/releases#create-a-release

https://docs.github.com/en/rest/releases/releases?apiVersion=2026-03-10#create-a-release--fine-grained-access-tokens

[NotMyFault]

permissions:
  contents: read

and

with:
  token: ${{ secrets.GITHUB_TOKEN }}

should lead to the desired result. That's what we're using at https://github.com/jenkinsci/jenkins/blob/master/.github/workflows/changelog.yml, where I got this original workflow from.

[Timongcraft]

The job needs write permission, no?
https://github.com/jenkinsci/jenkins/blob/master/.github/workflows/changelog.yml#L19

[NotMyFault]

That's needed as well, yea.

[NotMyFault]

I mean, the PR is failing still :/

[Timongcraft]

But aren't external PRs restricted or am I missing something?
Maybe open one from this repo?

[PierreSchwang]

Yes, iirc release drafter has always failed for PRs from foreign repositories - as it should. Could potentially update the action to not run in that case.

[Timongcraft]

Alright, but then the condition is broken/inverted because currently it skips for prs from the main repo: https://github.com/IntellectualSites/FastAsyncWorldEdit/actions/runs/26391439091/job/77681855616?pr=3540
https://github.com/IntellectualSites/FastAsyncWorldEdit/actions/runs/26363033492/job/77601805506?pr=3545

[PierreSchwang]

Not sure why it has to run on PRs either way, on push to main should suffice (just like Jenkins does it). Basically https://github.com/jenkinsci/jenkins/blob/ce830a65166fab4c7358bf6da44f8fdb29c1ce93/.github/workflows/changelog.yml#L5-L21