[Safe Outputs Conformance] TYPE-008: Conformance checker references stale permission function names (false CRITICAL/HIGH)

[github-actions]

Conformance Check Failure

Check ID: TYPE-008
Severity: CRITICAL (1 finding) + HIGH (1 finding), reported by scripts/check-safe-outputs-conformance.sh
Category: Implementation / Tooling (conformance checker itself)

Problem Description

The conformance checker's TYPE-008 check greps pkg/workflow/safe_output_handlers.go for the permission-builder function names NewPermissionsContentsReadChecksWrite and NewPermissionsContentsReadChecksWritePRRead and fails CRITICAL/HIGH when they are absent.

This is a false positive — the check is testing for the wrong function names. The actual create-check-run handler registration (pkg/workflow/safe_output_handlers.go around line 255-266) uses NewPermissionsChecksWrite() and NewPermissionsChecksWritePRRead() (no contents: read), which is exactly what the specification requires:

Section 7.3 (v1.23.0) Changelog: "Dual-permission profile for create_check_run: checks: write when no target is configured; adds pull-requests: read when target is set (required for PR head SHA resolution via GET /repos/{owner}/{repo}/pulls/{pull_number})."

The spec does not require contents: read for this handler, so the implementation is correct and follows least-privilege — it's the checker's expected function names that are stale.

Separately, pkg/workflow/permissions_factory.go (lines 169-185) defines the two functions the checker looks for (NewPermissionsContentsReadChecksWrite, NewPermissionsContentsReadChecksWritePRRead), but grepping the whole repo shows they are never called anywhere except their own definitions (and are mirrored into the generated pkg/workflow/README.md reference table). They are dead code, likely left over from an earlier draft of the create_check_run implementation that was later simplified to drop the unneeded contents: read scope — while the checker script wasn't updated to match.

Affected Components

• Files:
  • scripts/check-safe-outputs-conformance.sh (lines 1622-1632) — checks for wrong function names
  • pkg/workflow/permissions_factory.go (lines 169-185) — unused dead-code functions
  • pkg/workflow/README.md (lines ~1482-1483) — generated doc entries for the dead functions
• Correct/unaffected: pkg/workflow/safe_output_handlers.go (create-check-run registration) and pkg/workflow/compiler_safe_outputs_steps.go (GitHub App token minting) are already spec-compliant and need no changes.

🔍 Current vs Expected Behavior

Current Behavior

check_create_check_run_handler() in scripts/check-safe-outputs-conformance.sh runs:

if ! grep -q "NewPermissionsContentsReadChecksWrite" "$handler_registry"; then
    log_critical "TYPE-008: create_check_run dual-permission profile missing checks:write base permission (Section 7.3 v1.23.0)"
fi
if ! grep -q "NewPermissionsContentsReadChecksWritePRRead" "$handler_registry"; then
    log_high "TYPE-008: create_check_run dual-permission profile missing pull-requests:read when target configured (Section 7.3 v1.23.0)"
fi

Both greps fail because the registry actually uses NewPermissionsChecksWrite() / NewPermissionsChecksWritePRRead(), producing a false CRITICAL + HIGH failure every run.

Expected Behavior

The checker should assert the function names that are actually wired up and spec-compliant (NewPermissionsChecksWrite, NewPermissionsChecksWritePRRead), and the unused NewPermissionsContentsReadChecksWrite* functions should either be removed as dead code or, if there's a reason to keep them, clearly marked as deprecated/unused so they don't get grepped for by mistake again.

Remediation Steps

This task can be assigned to a Copilot coding agent with the following steps:

1. In scripts/check-safe-outputs-conformance.sh, update the check_create_check_run_handler function (around lines 1624-1632) to grep for NewPermissionsChecksWrite and NewPermissionsChecksWritePRRead instead of the ContentsRead variants.
2. In pkg/workflow/permissions_factory.go, remove the unused NewPermissionsContentsReadChecksWrite and NewPermissionsContentsReadChecksWritePRRead functions (lines 169-185), confirming first with grep -rn "NewPermissionsContentsReadChecksWrite" --include="*.go" that no other caller depends on them.
3. Regenerate pkg/workflow/README.md (or manually remove the now-stale entries for these two functions) so the generated reference table matches the actual factory functions.
4. Run go build ./... and the existing Go test suite for pkg/workflow to confirm nothing else references the removed functions.

Verification

After remediation, verify the fix by running:

bash scripts/check-safe-outputs-conformance.sh

Check TYPE-008 should report [PASS] with no CRITICAL/HIGH findings.

References

• Safe Outputs Specification: docs/src/content/docs/specs/safe-outputs-specification.md (Section 7.3, v1.23.0 changelog entry)
• Conformance Checker: scripts/check-safe-outputs-conformance.sh (TYPE-008, lines 1599-1663)
• Run ID: 30610005667
• Date: 2026-07-31

Generated by ✅ Daily Safe Outputs Conformance Checker · agent · 59.7 AIC · ⌖ 5.78 AIC · ⊞ 6.8K · ◷

• expires on Jul 31, 2026, 10:39 PM UTC-08:00