Fix check_release_notes 403 by restoring pull-requests: write and making the comment non-fatal

The check_release_notes job posts an informational comment on the PR. Creating a PR comment requires pull-requests: write, but #20081 reduced the token to pull-requests: read. Because the job runs via pull_request_target (GitHub executes the workflow from the default branch), this turned the required check red with HTTP 403 'Resource not accessible by integration' on any PR that needed to create (not update) the comment - e.g. the Maestro/darc PR #20133 targeting release/dev18.0 - even though release-notes validation itself passed.

Restore pull-requests: write so the comment can actually be posted, and additionally guard the comment step with continue-on-error plus a try/catch that downgrades any failure to a warning. The real gate (exit 1 when release notes are genuinely missing) is unchanged, and no PR content is evaluated as JavaScript.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: Copilot

.github/workflows/check_release_notes.yml

@@ -8,7 +8,7 @@ on:
 permissions:
   contents: read
   issues: write
-  pull-requests: read
+  pull-requests: write
 concurrency:
   group: release-notes-${{ github.event.pull_request.number }}
   cancel-in-progress: true
@@ -17,7 +17,7 @@ jobs:
     permissions:
       contents: read
       issues: write
-      pull-requests: read
+      pull-requests: write
     env:
       GH_TOKEN: ${{ github.token }}
       PR_AUTHOR: ${{ github.event.pull_request.user.login }}
@@ -305,38 +305,51 @@ jobs:
             exit 1
         fi
     # Keep one bot comment current without evaluating pull request content as JavaScript.
+    # Posting the informational comment is best-effort and must never fail the check:
+    # this job runs via pull_request_target, and the Actions GITHUB_TOKEN is not always
+    # permitted to create a new issue comment (the comment API can return HTTP 403
+    # "Resource not accessible by integration"), even though release-notes validation
+    # above has already succeeded.
     - name: Create or update comment
       if: ${{ (success() || failure()) && steps.release_notes_changes.outputs.release-notes-check-message != '' }}
+      continue-on-error: true
       uses: actions/github-script@v9
       env:
         COMMENT_BODY: ${{ steps.release_notes_changes.outputs.release-notes-check-message }}
       with:
         github-token: ${{ github.token }}
         script: |
             const marker = '<!-- DO_NOT_REMOVE: release_notes_check -->';
-            const comments = await github.paginate(github.rest.issues.listComments, {
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                issue_number: context.issue.number,
-                per_page: 100
-            });
-            const existing = comments.find(comment =>
-                comment.user?.login === 'github-actions[bot]' && comment.body?.includes(marker));
-
-            if (existing) {
-                const comment = await github.rest.issues.updateComment({
+            try {
+                const comments = await github.paginate(github.rest.issues.listComments, {
+                    owner: context.repo.owner,
+                    repo: context.repo.repo,
+                    issue_number: context.issue.number,
+                    per_page: 100
+                });
+                const existing = comments.find(comment =>
+                    comment.user?.login === 'github-actions[bot]' && comment.body?.includes(marker));
+
+                if (existing) {
+                    const comment = await github.rest.issues.updateComment({
+                        owner: context.repo.owner,
+                        repo: context.repo.repo,
+                        comment_id: existing.id,
+                        body: process.env.COMMENT_BODY
+                    });
+                    return comment.data.id;
+                }
+
+                const comment = await github.rest.issues.createComment({
+                    issue_number: context.issue.number,
                     owner: context.repo.owner,
                     repo: context.repo.repo,
-                    comment_id: existing.id,
                     body: process.env.COMMENT_BODY
                 });
                 return comment.data.id;
+            } catch (error) {
+                // The comment is informational only. The release-notes verdict is enforced by the
+                // "Check for release notes changes" step, so never fail the job if posting fails
+                // (e.g. a read-only token on some pull requests).
+                core.warning(`Unable to post release-notes comment: ${error.message}`);
             }
-
-            const comment = await github.rest.issues.createComment({
-                issue_number: context.issue.number,
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                body: process.env.COMMENT_BODY
-            });
-            return comment.data.id;