ci: grant pull-requests write to SDK compliance caller

[spydon]

What

Adds pull-requests: write to the SDK Compliance workflow's top-level permissions so the reusable workflow it calls can run.

Why

Every PR run of this workflow has failed with startup_failure since 2026-07-15. It is not caused by any individual PR.

The workflow calls the @main-pinned reusable workflow supabase/sdk/.github/workflows/validate-sdk-compliance-python.yml. In supabase/sdk #60 (commit 45dba43), the reusable workflow's check job started requesting pull-requests: write so it can post the capability matrix drift comment.

A called reusable workflow's GITHUB_TOKEN permissions can only be equal to or more restrictive than the caller's. This caller only granted contents: read, so the reusable workflow requesting a scope the caller does not have makes GitHub reject the run at compile time, before any job starts.

Granting pull-requests: write in the caller lets the token be passed down so the drift comment step can post.

Notes

• Same fix already applied for supabase-flutter in ci: grant pull-requests write to SDK compliance caller supabase-flutter#1611; all consumers of these reusable workflows need it.
• The drift check posts/updates a sticky PR comment; it is best-effort and swallows 403s on fork PRs.

[github-actions]

⚠️ Capability matrix drift detected

The following capabilities are marked implemented in the matrix but could not be found in python:

• database.configuration.auto_retry → expected symbol: AsyncSelectRequestBuilder.retry
• database.configuration.auto_retry → expected symbol: SyncSelectRequestBuilder.retry
• realtime.client.connect → expected symbol: SyncRealtimeClient.connect
• realtime.client.disconnect → expected symbol: AsyncRealtimeClient.disconnect
• realtime.client.disconnect → expected symbol: SyncRealtimeClient.disconnect
• realtime.channel.subscribe → expected symbol: SyncRealtimeChannel.subscribe
• realtime.channel.unsubscribe → expected symbol: SyncRealtimeChannel.unsubscribe
• realtime.channel.send → expected symbol: SyncRealtimeChannel.send_broadcast
• realtime.subscriptions.broadcast → expected symbol: SyncRealtimeChannel.on_broadcast
• realtime.subscriptions.postgres_changes → expected symbol: SyncRealtimeChannel.on_postgres_changes
• realtime.subscriptions.subscribe_presence → expected symbol: AsyncRealtimeChannel.on_presence_change
• realtime.subscriptions.subscribe_presence → expected symbol: SyncRealtimeChannel.on_presence_change
• realtime.presence.track → expected symbol: SyncRealtimeChannel.track
• realtime.presence.untrack → expected symbol: SyncRealtimeChannel.untrack
• realtime.presence.presence_state → expected symbol: AsyncRealtimeChannel.presences
• realtime.presence.presence_state → expected symbol: SyncRealtimeChannel.presences

The following capabilities are marked implemented in python but have no registered symbols to verify:

• auth.session.auto_refresh (no symbols list — cannot confirm implementation exists)
• client.authentication_integration.cross_client_token_sync (no symbols list — cannot confirm implementation exists)
• client.authentication_integration.oauth_flow_type (no symbols list — cannot confirm implementation exists)
• client.session_management.custom_storage (no symbols list — cannot confirm implementation exists)
• client.session_management.persist_session (no symbols list — cannot confirm implementation exists)
• client.request_configuration.custom_http_client (no symbols list — cannot confirm implementation exists)
• client.request_configuration.global_headers (no symbols list — cannot confirm implementation exists)
• database.mutate.select_after_mutation (no symbols list — cannot confirm implementation exists)
• database.using_filters.eq (no symbols list — cannot confirm implementation exists)
• database.using_filters.neq (no symbols list — cannot confirm implementation exists)
• database.using_filters.gt (no symbols list — cannot confirm implementation exists)
• database.using_filters.gte (no symbols list — cannot confirm implementation exists)
• database.using_filters.lt (no symbols list — cannot confirm implementation exists)
• database.using_filters.lte (no symbols list — cannot confirm implementation exists)
• database.using_filters.like (no symbols list — cannot confirm implementation exists)
• database.using_filters.ilike (no symbols list — cannot confirm implementation exists)
• database.using_filters.is (no symbols list — cannot confirm implementation exists)
• database.using_filters.in (no symbols list — cannot confirm implementation exists)
• database.using_filters.contains (no symbols list — cannot confirm implementation exists)
• database.using_filters.contained_by (no symbols list — cannot confirm implementation exists)
• database.using_filters.range_gt (no symbols list — cannot confirm implementation exists)
• database.using_filters.range_gte (no symbols list — cannot confirm implementation exists)
• database.using_filters.range_lt (no symbols list — cannot confirm implementation exists)
• database.using_filters.range_lte (no symbols list — cannot confirm implementation exists)
• database.using_filters.range_adjacent (no symbols list — cannot confirm implementation exists)
• database.using_filters.overlaps (no symbols list — cannot confirm implementation exists)
• database.using_filters.text_search (no symbols list — cannot confirm implementation exists)
• database.using_filters.match (no symbols list — cannot confirm implementation exists)
• database.using_filters.not (no symbols list — cannot confirm implementation exists)
• database.using_filters.or (no symbols list — cannot confirm implementation exists)
• database.using_filters.raw (no symbols list — cannot confirm implementation exists)
• database.using_filters.regex (no symbols list — cannot confirm implementation exists)
• database.using_filters.regex_icase (no symbols list — cannot confirm implementation exists)
• database.using_filters.not_in (no symbols list — cannot confirm implementation exists)
• database.using_modifiers.order (no symbols list — cannot confirm implementation exists)
• database.using_modifiers.limit (no symbols list — cannot confirm implementation exists)
• database.using_modifiers.range (no symbols list — cannot confirm implementation exists)
• database.using_modifiers.request_cancellation (no symbols list — cannot confirm implementation exists)
• database.using_modifiers.relationship_embed (no symbols list — cannot confirm implementation exists)
• database.configuration.request_timeout (no symbols list — cannot confirm implementation exists)
• functions.invocation.region_selection (no symbols list — cannot confirm implementation exists)
• functions.invocation.request_cancellation (no symbols list — cannot confirm implementation exists)
• functions.invocation.timeout (no symbols list — cannot confirm implementation exists)
• realtime.subscriptions.postgres_changes_filter (no symbols list — cannot confirm implementation exists)
• realtime.subscriptions.private_channel (no symbols list — cannot confirm implementation exists)
• realtime.subscriptions.broadcast_self (no symbols list — cannot confirm implementation exists)
• realtime.subscriptions.broadcast_replay (no symbols list — cannot confirm implementation exists)
• realtime.presence.presence_key (no symbols list — cannot confirm implementation exists)
• realtime.configuration.heartbeat_interval (no symbols list — cannot confirm implementation exists)
• storage.file_buckets.access_bucket (no symbols list — cannot confirm implementation exists)

These may have been renamed, removed, or never registered. Please update the capability matrix.
See: https://github.com/supabase/sdk/blob/main/docs/capability-matrix.md