docs: fix outdated permissions and example workflows

[shenxianpeng]

Summary

Docs/code consistency pass against action.yml and the pinned cpp-linter 1.14.1.

• docs/permissions.md: the thread-comments push snippet listed metadata: read, which is not a valid key in a workflow permissions: block (metadata read access is always granted). Copying the snippet would fail the workflow. Removed it and merged the footnotes.
• only-PR-comments.yml recipe: added contents: read (the job also runs on push, and checkout of private repos needs it), and only enables thread-comments for PRs from the same repo, matching the README's fork guard (fork PRs get a read-only token, so posting fails).
• auto-fix.yml recipe: the example page lists three annotations, but the YAML had no (n) markers, so they were not attached to any line. Added them.

Related Issues

None.

Summary by CodeRabbit

• Documentation
  • Updated the permissions example to show contents: write as the sole permission for commit-comment actions, with revised guidance on what it allows.
• Examples
  • The pull-request comment workflow now grants read access to repository contents and enables comment updates only for pull requests from the same repository.
  • Added numbered markers to comments in the auto-fix workflow example.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: a45f76ca-eefc-4a02-acbd-481f327b4ec5

📥 Commits

Reviewing files that changed from the base of the PR and between 6eae5f9 and 85a3d0d.

📒 Files selected for processing: 3

• .github/workflows/examples/auto-fix.yml
• .github/workflows/examples/only-PR-comments.yml
• docs/permissions.md

Included review availability: This review used your included allowance. Your plan provides up to 2 included reviews per hour; 1 remain after this review.

Walkthrough

The workflow examples add numbered comment labels, grant contents read access, and restrict thread-comment updates to pull requests from the same repository. The permissions documentation describes contents write for push-event commit-comment operations.

Changes

Auto-Fix Comment Labels

Layer / File(s)	Summary
Numbered example comments .github/workflows/examples/auto-fix.yml	The comments for style, tidy-checks, and auto-fix now include numbered markers. Configuration values are unchanged.

Thread Comment Permissions

Layer / File(s)	Summary
Thread-comment permissions and update conditions .github/workflows/examples/only-PR-comments.yml, docs/permissions.md	The workflow adds contents: read and sets thread-comments to update only when the pull request head repository matches the workflow repository. The push-event documentation assigns fetching, posting, updating, and deleting commit comments to contents: write.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 85a3d

The examples use the documented permissions for pull-request and push comments, and the PR workflow skips fork comments. No concrete behavior mismatch remains, so mergeability risk is minimal.

Pre-merge checks: 5

Check name	Status	Explanation
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main changes to the permissions documentation and example workflows.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (3 skipped: 3 unsupported.)

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}