ci: fix claude action severity labeling

[Roasbeef]

The Claude Code GitHub Action was failing to add severity labels to PRs. The root cause was a permission denial at two levels: Claude was using gh api to hit the issues labels endpoint, but the action's default allowed tools only permit gh pr view, gh pr edit, and gh pr comment. So the tool call was rejected before it ever reached GitHub.

Even if the tool call had gone through, it would have failed anyway. The workflow's GitHub token permissions were set to read-only for both issues and pull-requests, meaning any write operation against the labels API would return a 403.

This change bumps the issues and pull-requests permissions to write so the token can actually modify labels. It also adds a prompt instruction telling Claude to use gh pr edit --add-label for labeling instead of gh api, which keeps the allowed tools as restricted as possible without needing to open up arbitrary API access.

The failed run that surfaced this: https://github.com/lightningnetwork/lnd/actions/runs/21614145381/job/62289184152. You can see in the output that the gh api call shows up in the permission_denials array, confirming the tool was blocked by Claude Code's own sandboxing before the GitHub API was ever contacted.

[gemini-code-assist]

Note

Gemini is unable to generate a summary for this pull request due to the file types involved not being currently supported.

[Roasbeef]

Closing - the pr-severity.yml workflow already handles this correctly. The permission denial was benign (Claude retried with the allowed tool).

[lightninglabs-deploy]

🟢 PR Severity: LOW

CI/CD config change | 1 file | 13 lines changed

🟢 Low (1 file)

• .github/workflows/claude.yml - CI/CD workflow configuration update

Analysis

This PR modifies only the Claude GitHub Actions workflow configuration (.github/workflows/claude.yml). Changes to CI/CD configuration files fall under the LOW severity category as they:

• Do not affect runtime code or protocol behavior
• Are limited to GitHub Actions automation
• Can be reviewed and validated through CI test runs
• Have minimal risk to production systems

The change appears to fix the severity labeling logic in the Claude action itself, which is a meta-improvement to the CI process.

---

_{To override, add a severity-override-{critical,high,medium,low} label.}