CI: grant pull-request read permission for verify-pr-title job to pr-verifier caller

[rh-dnagornuks]

Summary

A small PR to fix the issue that was present in kagenti/kagenti-operator repository CI workflow with the job to verify PR title failing due to missing permissions. Unlike the PR that fixed the job in that repository (rossoctl/operator#379), this one limits the permissions to the job specifically, rather than caller-wide (in case more jobs are added where permissions would need to be fine tuned differently).

Testing

• The job starts on PR creation and the test passes

Summary by CodeRabbit

• Chores
  • Updated workflow permissions configuration to enhance security controls.

[coderabbitai]

📝 Walkthrough

Walkthrough

The PR adds explicit job-level pull-requests: read permission to the verify-pr-title job in the GitHub Actions PR verifier workflow, allowing the job to access pull-request metadata while maintaining the workflow-level empty permission boundary.

Changes

PR Verifier Workflow Permission

Layer / File(s)	Summary
Job-level PR permission .github/workflows/pr-verifier.yml	The verify-pr-title job is granted job-level permissions.pull-requests: read, scoped to override the workflow-level empty permissions for this specific job.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~5 minutes

Poem

🐰 A rabbit hops to grant a job its sight,
To read the pull-request metadata right,
With permission scoped and boundary clear,
The verifier now sees all it holds dear! ✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: adding pull-request read permission to the verify-pr-title job in the pr-verifier workflow, which directly matches the changeset modifications.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[huang195]

Clean, well-scoped change. Adds pull-requests: read to the verify-pr-title job only (not caller-wide), which is the right least-privilege approach for the reusable pr-verifier-required.yml workflow — mirrors the operator fix in rossoctl/operator#379 but with tighter scoping.

Areas reviewed: CI / GitHub Actions
CI status: passing (the earlier Go CI (authlib) red was an unrelated flaky test — TestReverseProxy_Finisher_Allow — which passed on re-run)

LGTM.