[Safe Outputs Conformance] IMP-002: Conformance check uses wrong function name casing (false HIGH failure)

[github-actions]

Conformance Check Failure

Check ID: IMP-002
Severity: HIGH (false positive — script bug)
Category: Implementation

Problem Description

The IMP-002 conformance check in scripts/check-safe-outputs-conformance.sh searches for computePermissionsForSafeOutputs (lowercase c) but the actual exported Go function is ComputePermissionsForSafeOutputs (uppercase C). Since grep is case-sensitive by default, this check always reports a HIGH failure even though the function is correctly implemented.

This is a false positive: the permission computation function exists, is exported (correct Go convention for public functions), and is fully implemented. The check simply uses the wrong casing.

Affected Components

• Files: scripts/check-safe-outputs-conformance.sh (IMP-002 check, line ~350)
• Implementation file: pkg/workflow/safe_outputs_permissions.go

Current Behavior

[HIGH] IMP-002: Permission computation function not found

The grep command:

grep -q "computePermissionsForSafeOutputs" "pkg/workflow/safe_outputs_permissions.go"

…fails because the actual function declaration is:

func ComputePermissionsForSafeOutputs(safeOutputs *SafeOutputsConfig) *Permissions {
```

### Expected Behavior

The IMP-002 check should detect the exported function `ComputePermissionsForSafeOutputs` and report:
```
[PASS] IMP-002: Permission computation function exists

Remediation Steps

This task can be assigned to a Copilot coding agent with the following steps:

1. Open scripts/check-safe-outputs-conformance.sh and locate the IMP-002 check (around line 350).
2. Change the grep pattern from computePermissionsForSafeOutputs to ComputePermissionsForSafeOutputs (capital C).
3. Alternatively, use case-insensitive grep (grep -qi) so the check is resilient to future renames between exported/unexported variants.

Affected Code Location

# scripts/check-safe-outputs-conformance.sh ~line 350
check_permission_computation() {
    if [ -f "pkg/workflow/safe_outputs_permissions.go" ]; then
        # BUGGY: lowercase 'c' does not match exported Go function
        if grep -q "computePermissionsForSafeOutputs" "pkg/workflow/safe_outputs_permissions.go"; then
            log_pass "IMP-002: Permission computation function exists"
        else
            log_high "IMP-002: Permission computation function not found"
        fi
    else
        log_high "IMP-002: Permission computation file missing"
    fi
}

Fix:

if grep -q "ComputePermissionsForSafeOutputs" "pkg/workflow/safe_outputs_permissions.go"; then

Verification

After remediation, verify the fix by running:

bash scripts/check-safe-outputs-conformance.sh
```

The IMP-002 check should pass:
```
[PASS] IMP-002: Permission computation function exists

References

• Safe Outputs Specification: docs/src/content/docs/reference/safe-outputs-specification.md
• Conformance Checker: scripts/check-safe-outputs-conformance.sh
• Permission computation implementation: pkg/workflow/safe_outputs_permissions.go
• Run ID: §22316462213
• Date: 2026-02-23

Generated by Daily Safe Outputs Conformance Checker

• expires on Feb 24, 2026, 5:11 PM UTC