Publish test results cannot create check-runs with permissions: {} (403)

What happened?

Publish test results fails when Publish Unit Test Results posts to /repos/pydata/xarray/check-runs: GitHub returns 403 Resource not accessible by integration. The workflow sets permissions: {} and the publishing job has no override, so its GITHUB_TOKEN cannot create the check even after the JUnit files have been read successfully.

Minimal Complete Verifiable Example

This reproduces the denied request in a fork, independently of xarray's test suite:

name: Reproduce publisher permission
on: workflow_dispatch
permissions: {}
jobs:
  reproduce:
    runs-on: ubuntu-latest
    steps:
      - env:
          GH_TOKEN: ${{ github.token }}
        run: |
          gh api --method POST "repos/$GITHUB_REPOSITORY/check-runs" \
            -f name=publisher-permission-repro -f head_sha="$GITHUB_SHA" \
            -f status=completed -f conclusion=success

The request fails with HTTP 403. Adding job-level permissions: {checks: write} permits the identical request; both cases are checked in this isolated fork workflow.

The implicated configuration is .github/workflows/publish-test-results.yaml at c2998a7.

What did you expect to happen?

The CI-completion workflow should be able to publish its unit-test check. Its trigger currently documents a deliberate restriction to read-only permissions, so the publishing job's permission model needs to be reconciled with its check-creation step.

Relevant log output

Failing upstream job:

GITHUB_TOKEN Permissions
  Metadata: read
Detected 14 JUnit XML files (41.0 MiB)
Request POST /repos/pydata/xarray/check-runs failed with 403: Forbidden
github.GithubException.GithubException: Resource not accessible by integration: 403

Environment

Default-branch workflow at c2998a75ef32f6cf4d62cd946f2200ca953550d9, using EnricoMi/publish-unit-test-result-action@d0a4676d0e0b938bc201470d88276b7c74c712b3 (v2.24.0). The isolated reproduction uses GitHub-hosted ubuntu-latest runners.

Investigated and reproduced by Codex on behalf of @glaziermag.

Start with .github/workflows/publish-test-results.yaml at commit c2998a7, then compare the workflow's top-level and publishing-job permissions with the documented checks API requirement. Use the isolated fork workflow and the failing upstream job as references. Done means the publishing job can create its check-run while the workflow's intended read-only restrictions remain reconciled.