From 85a3d0deb1d89b167450efa2d9c6718f872003b8 Mon Sep 17 00:00:00 2001
From: Xianpeng Shen <3353385+shenxianpeng@users.noreply.github.com>
Date: Sun, 18 Oct 2026 21:48:01 +0000
Subject: [PATCH] docs: fix outdated permissions and example workflows

---
 .github/workflows/examples/auto-fix.yml         | 6 +++---
 .github/workflows/examples/only-PR-comments.yml | 4 +++-
 docs/permissions.md                             | 8 +++-----
 3 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/examples/auto-fix.yml b/.github/workflows/examples/auto-fix.yml
index aeda08d3..7231474e 100644
--- a/.github/workflows/examples/auto-fix.yml
+++ b/.github/workflows/examples/auto-fix.yml
@@ -21,9 +21,9 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
-          style: 'file'  # Use .clang-format config file
-          tidy-checks: '-*'  # disable clang-tidy
-          auto-fix: 'true'  # auto-apply clang-format fixes
+          style: 'file'  # Use .clang-format config file. (2)
+          tidy-checks: '-*'  # disable clang-tidy. (3)
+          auto-fix: 'true'  # auto-apply clang-format fixes. (1)
 
       - name: Fail fast?!
         if: steps.linter.outputs.clang-format-checks-failed > 0
diff --git a/.github/workflows/examples/only-PR-comments.yml b/.github/workflows/examples/only-PR-comments.yml
index 22505633..30facea3 100644
--- a/.github/workflows/examples/only-PR-comments.yml
+++ b/.github/workflows/examples/only-PR-comments.yml
@@ -11,6 +11,7 @@ jobs:
   cpp-linter:
     runs-on: ubuntu-latest
     permissions: # (1)!
+      contents: read
       pull-requests: write
     steps:
       - uses: actions/checkout@v7
@@ -25,7 +26,8 @@ jobs:
           style: 'file'  # Use .clang-format config file. (2)
           tidy-checks: '' # Use .clang-tidy config file. (3)
           # only 'update' a single comment in a pull request's thread. (4)
-          thread-comments: ${{ github.event_name == 'pull_request' && 'update' }}
+          # Pull requests from forks get a read-only token, so skip the comment there.
+          thread-comments: ${{ github.event.pull_request.head.repo.full_name == github.repository && 'update' }}
 
       - name: Fail fast?!
         if: steps.linter.outputs.checks-failed > 0
diff --git a/docs/permissions.md b/docs/permissions.md
index b6a54791..5d84fb7b 100644
--- a/docs/permissions.md
+++ b/docs/permissions.md
@@ -53,13 +53,11 @@ The [`thread-comments`](inputs-outputs.md#thread-comments) feature requires the
 
     ```yaml
         permissions:
-          metadata: read # (1)!
-          contents: write # (2)!
+          contents: write # (1)!
     ```
 
-    1. needed to fetch existing comments
-    2. needed to post or update a commit comment. This also allows us to delete
-       an outdated comment if needed.
+    1. needed to fetch existing comments and to post or update a commit comment.
+       This also allows us to delete an outdated comment if needed.
 
 === "`#!yaml on: pull_request`"