Sema automated code review GitHub app permission boundary

Sema provides automated code review by analyzing pull requests and posting review comments, suggestions and issue flags directly on the PR in the connected Git host. Configuration is managed through a dashboard and repository-level settings that control which repositories are monitored and which review behaviors are enabled.

The goal is to enable automated review with a least-privilege GitHub app installation. The security constraint requires contents read and pull requests write only, and rejects broader repository permissions. It is unclear whether Sema functions fully with that boundary or requires additional scopes for metadata access, check runs, or settings updates.

Does Sema require scopes beyond contents read and pull requests write to post review comments and suggestions on a PR? Are repository-level settings and rule configuration accessible with read-only contents access? What permission set is documented as the minimal required for full automated review functionality?