ci: fix permissions when publishing PR report

Author: reubenmiller

.github/workflows/test.yml

@@ -33,9 +33,6 @@ jobs:
       name: Test Auto
     runs-on: ubuntu-22.04
     permissions:
-      # Required to publish system test results to the PR
-      issues: write
-      pull-requests: write
       contents: read
     env:
       COMPOSE_PROJECT_NAME: ci_${{github.run_id}}_${{github.run_attempt || '1'}}
@@ -106,6 +103,11 @@ jobs:
     if: ${{ always() && github.event_name == 'pull_request_target' }}
     needs: [approve, test]
     runs-on: ubuntu-latest
+    permissions:
+      # Required to publish system test results to the PR
+      issues: write
+      pull-requests: write
+      contents: read
     steps:
     - uses: actions/checkout@v4
     - name: Download reports