[Copilot]

The scheduled advisory check failed when audit-check tried to publish an issue for unmaintained-dependency warnings, but the job token lacked issue write access.

• Change: Grant the advisory job issues: write while retaining its existing checks: write permission.
• Configuration:

  permissions:
    checks: write
    issues: write

[schreck61]

Superseded by a2d464b on main, which grants the audit job issues: write as proposed here.

The diagnosis in this PR was correct, and confirmed against the run logs: the 2026-10-19 and 2026-10-26 sweeps both failed on nothing but POST /issues returning "Resource not accessible by integration", while cargo audit itself reported no vulnerabilities.

This branch could not be merged as-is because it forked before 8bfe66f: taking it would have reverted the three zbus-family advisory ignores (RUSTSEC-2026-0370/0371/0372) and the comment documenting them. Only the permission line carried over.

Two details were adjusted against the action's source at the pinned SHA. Issues are filed on the schedule event only -- push and pull_request post a check run instead -- so the permission comment now says so. And reportIssues returns without failing the job, so a new advisory arrives as a deduplicated issue on a green run rather than a red build; the ignore-list comment now records that, since it replaces the previous signal.