From 6a2c70b50d4f180e12fe13325e9cf8741c6eddc1 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Wed, 25 Feb 2026 11:38:28 +0000 Subject: [PATCH 1/3] Initial plan From 69b0d931835c4bf844e9677c0ab20c96f827d3bb Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Wed, 25 Feb 2026 11:55:42 +0000 Subject: [PATCH 2/3] Fix: add pull-requests:write to safe_outputs job when add-comment is configured - Add Issues and PullRequests fields to AddCommentsConfig struct - Default: issues=true (issues:write), pull-requests=true (pull-requests:write), discussions=false (no discussions:write) - Update buildCreateOutputAddCommentJob to use dynamic permissions and conditions - Add buildAddCommentPermissions helper shared by job builder and permissions calculator - Update ComputePermissionsForSafeOutputs to use the new helper - Update JSON schema with issues and pull-requests boolean properties - Update tests to reflect new default behavior - Recompile all workflow lock files Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> --- .../agent-performance-analyzer.lock.yml | 2 + .github/workflows/archie.lock.yml | 4 +- .github/workflows/brave.lock.yml | 4 +- .github/workflows/ci-doctor.lock.yml | 4 +- .github/workflows/cloclo.lock.yml | 2 - .github/workflows/contribution-check.lock.yml | 2 - .github/workflows/craft.lock.yml | 2 - .../daily-assign-issue-to-user.lock.yml | 4 +- .../workflows/daily-cli-performance.lock.yml | 4 +- .github/workflows/daily-fact.lock.yml | 4 +- .github/workflows/dev-hawk.lock.yml | 4 +- .../workflows/discussion-task-miner.lock.yml | 4 +- .github/workflows/draft-pr-cleanup.lock.yml | 2 - .github/workflows/issue-monster.lock.yml | 4 +- .github/workflows/issue-triage-agent.lock.yml | 2 - .github/workflows/pdf-summary.lock.yml | 2 + .github/workflows/pr-triage-agent.lock.yml | 2 - .github/workflows/q.lock.yml | 2 - .github/workflows/refiner.lock.yml | 2 - .github/workflows/scout.lock.yml | 4 +- .github/workflows/smoke-agent.lock.yml | 4 +- .github/workflows/smoke-claude.lock.yml | 2 - .github/workflows/smoke-gemini.lock.yml | 2 - .github/workflows/smoke-multi-pr.lock.yml | 2 - .github/workflows/smoke-project.lock.yml | 2 - .github/workflows/smoke-temporary-id.lock.yml | 4 +- .github/workflows/smoke-test-tools.lock.yml | 4 +- .github/workflows/sub-issue-closer.lock.yml | 4 +- .../workflows/technical-doc-writer.lock.yml | 2 - .github/workflows/unbloat-docs.lock.yml | 2 - .../workflow-health-manager.lock.yml | 4 +- pkg/parser/schemas/main_workflow_schema.json | 10 +++- pkg/workflow/add_comment.go | 60 +++++++++++++------ pkg/workflow/safe_outputs_permissions.go | 9 +-- pkg/workflow/safe_outputs_permissions_test.go | 50 ++++++++++++++-- 35 files changed, 132 insertions(+), 89 deletions(-) diff --git a/.github/workflows/agent-performance-analyzer.lock.yml b/.github/workflows/agent-performance-analyzer.lock.yml index 8de56623d9f..4efe9e50fd7 100644 --- a/.github/workflows/agent-performance-analyzer.lock.yml +++ b/.github/workflows/agent-performance-analyzer.lock.yml @@ -1149,6 +1149,7 @@ jobs: contents: read discussions: write issues: write + pull-requests: write outputs: noop_message: ${{ steps.noop.outputs.noop_message }} tools_reported: ${{ steps.missing_tool.outputs.tools_reported }} @@ -1349,6 +1350,7 @@ jobs: contents: read discussions: write issues: write + pull-requests: write timeout-minutes: 15 env: GH_AW_ENGINE_ID: "copilot" diff --git a/.github/workflows/archie.lock.yml b/.github/workflows/archie.lock.yml index 079474ab18a..d99b1de2bd7 100644 --- a/.github/workflows/archie.lock.yml +++ b/.github/workflows/archie.lock.yml @@ -980,8 +980,8 @@ jobs: runs-on: ubuntu-slim permissions: contents: read - discussions: write issues: write + pull-requests: write outputs: noop_message: ${{ steps.noop.outputs.noop_message }} tools_reported: ${{ steps.missing_tool.outputs.tools_reported }} @@ -1143,8 +1143,8 @@ jobs: runs-on: ubuntu-slim permissions: contents: read - discussions: write issues: write + pull-requests: write timeout-minutes: 15 env: GH_AW_ENGINE_ID: "copilot" diff --git a/.github/workflows/brave.lock.yml b/.github/workflows/brave.lock.yml index 347c717ec2b..8c4ad9b990f 100644 --- a/.github/workflows/brave.lock.yml +++ b/.github/workflows/brave.lock.yml @@ -968,8 +968,8 @@ jobs: runs-on: ubuntu-slim permissions: contents: read - discussions: write issues: write + pull-requests: write outputs: noop_message: ${{ steps.noop.outputs.noop_message }} tools_reported: ${{ steps.missing_tool.outputs.tools_reported }} @@ -1128,8 +1128,8 @@ jobs: runs-on: ubuntu-slim permissions: contents: read - discussions: write issues: write + pull-requests: write timeout-minutes: 15 env: GH_AW_ENGINE_ID: "copilot" diff --git a/.github/workflows/ci-doctor.lock.yml b/.github/workflows/ci-doctor.lock.yml index 795afc0e8f6..c83ecf99c0c 100644 --- a/.github/workflows/ci-doctor.lock.yml +++ b/.github/workflows/ci-doctor.lock.yml @@ -1175,8 +1175,8 @@ jobs: runs-on: ubuntu-slim permissions: contents: read - discussions: write issues: write + pull-requests: write outputs: noop_message: ${{ steps.noop.outputs.noop_message }} tools_reported: ${{ steps.missing_tool.outputs.tools_reported }} @@ -1326,8 +1326,8 @@ jobs: runs-on: ubuntu-slim permissions: contents: read - discussions: write issues: write + pull-requests: write timeout-minutes: 15 env: GH_AW_ENGINE_ID: "copilot" diff --git a/.github/workflows/cloclo.lock.yml b/.github/workflows/cloclo.lock.yml index ef5585a2d24..f31e50ecb2d 100644 --- a/.github/workflows/cloclo.lock.yml +++ b/.github/workflows/cloclo.lock.yml @@ -1323,7 +1323,6 @@ jobs: runs-on: ubuntu-slim permissions: contents: write - discussions: write issues: write pull-requests: write outputs: @@ -1515,7 +1514,6 @@ jobs: runs-on: ubuntu-slim permissions: contents: write - discussions: write issues: write pull-requests: write timeout-minutes: 15 diff --git a/.github/workflows/contribution-check.lock.yml b/.github/workflows/contribution-check.lock.yml index dc29766a7ea..a664b8f7e01 100644 --- a/.github/workflows/contribution-check.lock.yml +++ b/.github/workflows/contribution-check.lock.yml @@ -1019,7 +1019,6 @@ jobs: runs-on: ubuntu-slim permissions: contents: read - discussions: write issues: write pull-requests: write outputs: @@ -1118,7 +1117,6 @@ jobs: runs-on: ubuntu-slim permissions: contents: read - discussions: write issues: write pull-requests: write timeout-minutes: 15 diff --git a/.github/workflows/craft.lock.yml b/.github/workflows/craft.lock.yml index 33b4f859820..54591b11821 100644 --- a/.github/workflows/craft.lock.yml +++ b/.github/workflows/craft.lock.yml @@ -1003,7 +1003,6 @@ jobs: runs-on: ubuntu-slim permissions: contents: write - discussions: write issues: write pull-requests: write outputs: @@ -1167,7 +1166,6 @@ jobs: runs-on: ubuntu-slim permissions: contents: write - discussions: write issues: write pull-requests: write timeout-minutes: 15 diff --git a/.github/workflows/daily-assign-issue-to-user.lock.yml b/.github/workflows/daily-assign-issue-to-user.lock.yml index a7e7770a5ba..779f6d42654 100644 --- a/.github/workflows/daily-assign-issue-to-user.lock.yml +++ b/.github/workflows/daily-assign-issue-to-user.lock.yml @@ -962,8 +962,8 @@ jobs: runs-on: ubuntu-slim permissions: contents: read - discussions: write issues: write + pull-requests: write outputs: noop_message: ${{ steps.noop.outputs.noop_message }} tools_reported: ${{ steps.missing_tool.outputs.tools_reported }} @@ -1060,8 +1060,8 @@ jobs: runs-on: ubuntu-slim permissions: contents: read - discussions: write issues: write + pull-requests: write timeout-minutes: 15 env: GH_AW_ENGINE_ID: "copilot" diff --git a/.github/workflows/daily-cli-performance.lock.yml b/.github/workflows/daily-cli-performance.lock.yml index 6a11a56d38d..86a00085284 100644 --- a/.github/workflows/daily-cli-performance.lock.yml +++ b/.github/workflows/daily-cli-performance.lock.yml @@ -1176,8 +1176,8 @@ jobs: runs-on: ubuntu-slim permissions: contents: read - discussions: write issues: write + pull-requests: write outputs: noop_message: ${{ steps.noop.outputs.noop_message }} tools_reported: ${{ steps.missing_tool.outputs.tools_reported }} @@ -1347,8 +1347,8 @@ jobs: runs-on: ubuntu-slim permissions: contents: read - discussions: write issues: write + pull-requests: write timeout-minutes: 15 env: GH_AW_ENGINE_ID: "copilot" diff --git a/.github/workflows/daily-fact.lock.yml b/.github/workflows/daily-fact.lock.yml index e7b0725fa7c..57e20637a6e 100644 --- a/.github/workflows/daily-fact.lock.yml +++ b/.github/workflows/daily-fact.lock.yml @@ -890,8 +890,8 @@ jobs: runs-on: ubuntu-slim permissions: contents: read - discussions: write issues: write + pull-requests: write outputs: noop_message: ${{ steps.noop.outputs.noop_message }} tools_reported: ${{ steps.missing_tool.outputs.tools_reported }} @@ -987,8 +987,8 @@ jobs: runs-on: ubuntu-slim permissions: contents: read - discussions: write issues: write + pull-requests: write timeout-minutes: 15 env: GH_AW_ENGINE_ID: "codex" diff --git a/.github/workflows/dev-hawk.lock.yml b/.github/workflows/dev-hawk.lock.yml index cbdeb6cca6a..ae8e6d9f30f 100644 --- a/.github/workflows/dev-hawk.lock.yml +++ b/.github/workflows/dev-hawk.lock.yml @@ -1030,8 +1030,8 @@ jobs: runs-on: ubuntu-slim permissions: contents: read - discussions: write issues: write + pull-requests: write outputs: noop_message: ${{ steps.noop.outputs.noop_message }} tools_reported: ${{ steps.missing_tool.outputs.tools_reported }} @@ -1161,8 +1161,8 @@ jobs: runs-on: ubuntu-slim permissions: contents: read - discussions: write issues: write + pull-requests: write timeout-minutes: 15 env: GH_AW_ENGINE_ID: "copilot" diff --git a/.github/workflows/discussion-task-miner.lock.yml b/.github/workflows/discussion-task-miner.lock.yml index 99514b55ada..55443717cd2 100644 --- a/.github/workflows/discussion-task-miner.lock.yml +++ b/.github/workflows/discussion-task-miner.lock.yml @@ -1051,8 +1051,8 @@ jobs: runs-on: ubuntu-slim permissions: contents: read - discussions: write issues: write + pull-requests: write outputs: noop_message: ${{ steps.noop.outputs.noop_message }} tools_reported: ${{ steps.missing_tool.outputs.tools_reported }} @@ -1223,8 +1223,8 @@ jobs: runs-on: ubuntu-slim permissions: contents: read - discussions: write issues: write + pull-requests: write timeout-minutes: 15 env: GH_AW_ENGINE_ID: "copilot" diff --git a/.github/workflows/draft-pr-cleanup.lock.yml b/.github/workflows/draft-pr-cleanup.lock.yml index eaa22c624fc..60b5f0f0cbd 100644 --- a/.github/workflows/draft-pr-cleanup.lock.yml +++ b/.github/workflows/draft-pr-cleanup.lock.yml @@ -991,7 +991,6 @@ jobs: runs-on: ubuntu-slim permissions: contents: read - discussions: write issues: write pull-requests: write outputs: @@ -1091,7 +1090,6 @@ jobs: runs-on: ubuntu-slim permissions: contents: read - discussions: write issues: write pull-requests: write timeout-minutes: 15 diff --git a/.github/workflows/issue-monster.lock.yml b/.github/workflows/issue-monster.lock.yml index fff8d24a5e8..c5606b352db 100644 --- a/.github/workflows/issue-monster.lock.yml +++ b/.github/workflows/issue-monster.lock.yml @@ -992,8 +992,8 @@ jobs: runs-on: ubuntu-slim permissions: contents: read - discussions: write issues: write + pull-requests: write outputs: noop_message: ${{ steps.noop.outputs.noop_message }} tools_reported: ${{ steps.missing_tool.outputs.tools_reported }} @@ -1150,8 +1150,8 @@ jobs: runs-on: ubuntu-slim permissions: contents: read - discussions: write issues: write + pull-requests: write timeout-minutes: 15 env: GH_AW_ENGINE_ID: "copilot" diff --git a/.github/workflows/issue-triage-agent.lock.yml b/.github/workflows/issue-triage-agent.lock.yml index 511cd22cdcb..05af309a1e5 100644 --- a/.github/workflows/issue-triage-agent.lock.yml +++ b/.github/workflows/issue-triage-agent.lock.yml @@ -932,7 +932,6 @@ jobs: runs-on: ubuntu-slim permissions: contents: read - discussions: write issues: write pull-requests: write outputs: @@ -1030,7 +1029,6 @@ jobs: runs-on: ubuntu-slim permissions: contents: read - discussions: write issues: write pull-requests: write timeout-minutes: 15 diff --git a/.github/workflows/pdf-summary.lock.yml b/.github/workflows/pdf-summary.lock.yml index 8765833c919..5966c720af9 100644 --- a/.github/workflows/pdf-summary.lock.yml +++ b/.github/workflows/pdf-summary.lock.yml @@ -1069,6 +1069,7 @@ jobs: contents: read discussions: write issues: write + pull-requests: write outputs: noop_message: ${{ steps.noop.outputs.noop_message }} tools_reported: ${{ steps.missing_tool.outputs.tools_reported }} @@ -1234,6 +1235,7 @@ jobs: contents: read discussions: write issues: write + pull-requests: write timeout-minutes: 15 env: GH_AW_ENGINE_ID: "copilot" diff --git a/.github/workflows/pr-triage-agent.lock.yml b/.github/workflows/pr-triage-agent.lock.yml index d668917b7b8..bd4ce70c683 100644 --- a/.github/workflows/pr-triage-agent.lock.yml +++ b/.github/workflows/pr-triage-agent.lock.yml @@ -1056,7 +1056,6 @@ jobs: runs-on: ubuntu-slim permissions: contents: read - discussions: write issues: write pull-requests: write outputs: @@ -1225,7 +1224,6 @@ jobs: runs-on: ubuntu-slim permissions: contents: read - discussions: write issues: write pull-requests: write timeout-minutes: 15 diff --git a/.github/workflows/q.lock.yml b/.github/workflows/q.lock.yml index c959d7f0f85..b19f3f6dfb1 100644 --- a/.github/workflows/q.lock.yml +++ b/.github/workflows/q.lock.yml @@ -1174,7 +1174,6 @@ jobs: runs-on: ubuntu-slim permissions: contents: write - discussions: write issues: write pull-requests: write outputs: @@ -1366,7 +1365,6 @@ jobs: runs-on: ubuntu-slim permissions: contents: write - discussions: write issues: write pull-requests: write timeout-minutes: 15 diff --git a/.github/workflows/refiner.lock.yml b/.github/workflows/refiner.lock.yml index caa98adb73f..32a76d6f14d 100644 --- a/.github/workflows/refiner.lock.yml +++ b/.github/workflows/refiner.lock.yml @@ -1018,7 +1018,6 @@ jobs: runs-on: ubuntu-slim permissions: contents: write - discussions: write issues: write pull-requests: write outputs: @@ -1170,7 +1169,6 @@ jobs: runs-on: ubuntu-slim permissions: contents: write - discussions: write issues: write pull-requests: write timeout-minutes: 15 diff --git a/.github/workflows/scout.lock.yml b/.github/workflows/scout.lock.yml index c8a1607cead..1fdb33e70f6 100644 --- a/.github/workflows/scout.lock.yml +++ b/.github/workflows/scout.lock.yml @@ -1163,8 +1163,8 @@ jobs: runs-on: ubuntu-slim permissions: contents: read - discussions: write issues: write + pull-requests: write outputs: noop_message: ${{ steps.noop.outputs.noop_message }} tools_reported: ${{ steps.missing_tool.outputs.tools_reported }} @@ -1335,8 +1335,8 @@ jobs: runs-on: ubuntu-slim permissions: contents: read - discussions: write issues: write + pull-requests: write timeout-minutes: 15 env: GH_AW_ENGINE_ID: "claude" diff --git a/.github/workflows/smoke-agent.lock.yml b/.github/workflows/smoke-agent.lock.yml index f3a4271e597..ce9cd4251fb 100644 --- a/.github/workflows/smoke-agent.lock.yml +++ b/.github/workflows/smoke-agent.lock.yml @@ -999,8 +999,8 @@ jobs: runs-on: ubuntu-slim permissions: contents: read - discussions: write issues: write + pull-requests: write outputs: noop_message: ${{ steps.noop.outputs.noop_message }} tools_reported: ${{ steps.missing_tool.outputs.tools_reported }} @@ -1153,8 +1153,8 @@ jobs: runs-on: ubuntu-slim permissions: contents: read - discussions: write issues: write + pull-requests: write timeout-minutes: 15 env: GH_AW_ENGINE_ID: "codex" diff --git a/.github/workflows/smoke-claude.lock.yml b/.github/workflows/smoke-claude.lock.yml index 40d3e047a15..a14038238f4 100644 --- a/.github/workflows/smoke-claude.lock.yml +++ b/.github/workflows/smoke-claude.lock.yml @@ -2559,7 +2559,6 @@ jobs: runs-on: ubuntu-slim permissions: contents: write - discussions: write issues: write pull-requests: write outputs: @@ -2732,7 +2731,6 @@ jobs: runs-on: ubuntu-slim permissions: contents: write - discussions: write issues: write pull-requests: write timeout-minutes: 15 diff --git a/.github/workflows/smoke-gemini.lock.yml b/.github/workflows/smoke-gemini.lock.yml index 9bc38f0de45..d3a3bf3cc08 100644 --- a/.github/workflows/smoke-gemini.lock.yml +++ b/.github/workflows/smoke-gemini.lock.yml @@ -1200,7 +1200,6 @@ jobs: runs-on: ubuntu-slim permissions: contents: read - discussions: write issues: write pull-requests: write outputs: @@ -1369,7 +1368,6 @@ jobs: runs-on: ubuntu-slim permissions: contents: read - discussions: write issues: write pull-requests: write timeout-minutes: 15 diff --git a/.github/workflows/smoke-multi-pr.lock.yml b/.github/workflows/smoke-multi-pr.lock.yml index 10dc1028964..694f3e1fb2f 100644 --- a/.github/workflows/smoke-multi-pr.lock.yml +++ b/.github/workflows/smoke-multi-pr.lock.yml @@ -1050,7 +1050,6 @@ jobs: runs-on: ubuntu-slim permissions: contents: write - discussions: write issues: write pull-requests: write outputs: @@ -1237,7 +1236,6 @@ jobs: runs-on: ubuntu-slim permissions: contents: write - discussions: write issues: write pull-requests: write timeout-minutes: 15 diff --git a/.github/workflows/smoke-project.lock.yml b/.github/workflows/smoke-project.lock.yml index 7d2e6e98d25..27f402ed6ae 100644 --- a/.github/workflows/smoke-project.lock.yml +++ b/.github/workflows/smoke-project.lock.yml @@ -1443,7 +1443,6 @@ jobs: runs-on: ubuntu-slim permissions: contents: write - discussions: write issues: write pull-requests: write outputs: @@ -1630,7 +1629,6 @@ jobs: runs-on: ubuntu-slim permissions: contents: write - discussions: write issues: write pull-requests: write timeout-minutes: 15 diff --git a/.github/workflows/smoke-temporary-id.lock.yml b/.github/workflows/smoke-temporary-id.lock.yml index c0833cefa2a..84b5b3cbaa4 100644 --- a/.github/workflows/smoke-temporary-id.lock.yml +++ b/.github/workflows/smoke-temporary-id.lock.yml @@ -1066,8 +1066,8 @@ jobs: runs-on: ubuntu-slim permissions: contents: read - discussions: write issues: write + pull-requests: write outputs: noop_message: ${{ steps.noop.outputs.noop_message }} tools_reported: ${{ steps.missing_tool.outputs.tools_reported }} @@ -1234,8 +1234,8 @@ jobs: runs-on: ubuntu-slim permissions: contents: read - discussions: write issues: write + pull-requests: write timeout-minutes: 15 env: GH_AW_ENGINE_ID: "copilot" diff --git a/.github/workflows/smoke-test-tools.lock.yml b/.github/workflows/smoke-test-tools.lock.yml index 13e3a93a301..640db9e7ec5 100644 --- a/.github/workflows/smoke-test-tools.lock.yml +++ b/.github/workflows/smoke-test-tools.lock.yml @@ -969,8 +969,8 @@ jobs: runs-on: ubuntu-slim permissions: contents: read - discussions: write issues: write + pull-requests: write outputs: noop_message: ${{ steps.noop.outputs.noop_message }} tools_reported: ${{ steps.missing_tool.outputs.tools_reported }} @@ -1121,8 +1121,8 @@ jobs: runs-on: ubuntu-slim permissions: contents: read - discussions: write issues: write + pull-requests: write timeout-minutes: 15 env: GH_AW_ENGINE_ID: "copilot" diff --git a/.github/workflows/sub-issue-closer.lock.yml b/.github/workflows/sub-issue-closer.lock.yml index f006d3a517b..7f2da71db74 100644 --- a/.github/workflows/sub-issue-closer.lock.yml +++ b/.github/workflows/sub-issue-closer.lock.yml @@ -1028,8 +1028,8 @@ jobs: runs-on: ubuntu-slim permissions: contents: read - discussions: write issues: write + pull-requests: write outputs: noop_message: ${{ steps.noop.outputs.noop_message }} tools_reported: ${{ steps.missing_tool.outputs.tools_reported }} @@ -1126,8 +1126,8 @@ jobs: runs-on: ubuntu-slim permissions: contents: read - discussions: write issues: write + pull-requests: write timeout-minutes: 15 env: GH_AW_ENGINE_ID: "copilot" diff --git a/.github/workflows/technical-doc-writer.lock.yml b/.github/workflows/technical-doc-writer.lock.yml index 84f8309cdfa..44df9bfbdb9 100644 --- a/.github/workflows/technical-doc-writer.lock.yml +++ b/.github/workflows/technical-doc-writer.lock.yml @@ -1098,7 +1098,6 @@ jobs: runs-on: ubuntu-slim permissions: contents: write - discussions: write issues: write pull-requests: write outputs: @@ -1216,7 +1215,6 @@ jobs: runs-on: ubuntu-slim permissions: contents: write - discussions: write issues: write pull-requests: write timeout-minutes: 15 diff --git a/.github/workflows/unbloat-docs.lock.yml b/.github/workflows/unbloat-docs.lock.yml index 2a2253d6e86..b48525fac45 100644 --- a/.github/workflows/unbloat-docs.lock.yml +++ b/.github/workflows/unbloat-docs.lock.yml @@ -1253,7 +1253,6 @@ jobs: runs-on: ubuntu-slim permissions: contents: write - discussions: write issues: write pull-requests: write outputs: @@ -1432,7 +1431,6 @@ jobs: runs-on: ubuntu-slim permissions: contents: write - discussions: write issues: write pull-requests: write timeout-minutes: 15 diff --git a/.github/workflows/workflow-health-manager.lock.yml b/.github/workflows/workflow-health-manager.lock.yml index 07cbf42547c..d05193b3baa 100644 --- a/.github/workflows/workflow-health-manager.lock.yml +++ b/.github/workflows/workflow-health-manager.lock.yml @@ -1145,8 +1145,8 @@ jobs: runs-on: ubuntu-slim permissions: contents: read - discussions: write issues: write + pull-requests: write outputs: noop_message: ${{ steps.noop.outputs.noop_message }} tools_reported: ${{ steps.missing_tool.outputs.tools_reported }} @@ -1343,8 +1343,8 @@ jobs: runs-on: ubuntu-slim permissions: contents: read - discussions: write issues: write + pull-requests: write timeout-minutes: 15 env: GH_AW_ENGINE_ID: "copilot" diff --git a/pkg/parser/schemas/main_workflow_schema.json b/pkg/parser/schemas/main_workflow_schema.json index 7b43a6fd097..f5e92e03633 100644 --- a/pkg/parser/schemas/main_workflow_schema.json +++ b/pkg/parser/schemas/main_workflow_schema.json @@ -5023,7 +5023,15 @@ }, "discussions": { "type": "boolean", - "description": "Controls whether the workflow requests discussions:write permission for add-comment. Default: true (includes discussions:write). Set to false if your GitHub App lacks Discussions permission to prevent 422 errors during token generation." + "description": "Controls whether the workflow requests discussions:write permission for add-comment and includes discussions in the event trigger condition. Default: false (excludes discussions:write). Set to true if you want the agent to comment on discussions." + }, + "issues": { + "type": "boolean", + "description": "Controls whether the workflow requests issues:write permission for add-comment and includes issues in the event trigger condition. Default: true (includes issues:write). Set to false to disable issue commenting." + }, + "pull-requests": { + "type": "boolean", + "description": "Controls whether the workflow requests pull-requests:write permission for add-comment and includes pull requests in the event trigger condition. Default: true (includes pull-requests:write). Set to false to disable pull request commenting." } }, "additionalProperties": false, diff --git a/pkg/workflow/add_comment.go b/pkg/workflow/add_comment.go index 6a68b19a00a..9e4ce590b5d 100644 --- a/pkg/workflow/add_comment.go +++ b/pkg/workflow/add_comment.go @@ -24,7 +24,9 @@ type AddCommentsConfig struct { Discussion *bool `yaml:"discussion,omitempty"` // Target discussion comments instead of issue/PR comments. Must be true if present. HideOlderComments *string `yaml:"hide-older-comments,omitempty"` // When true, minimizes/hides all previous comments from the same workflow before creating the new comment AllowedReasons []string `yaml:"allowed-reasons,omitempty"` // List of allowed reasons for hiding older comments (default: all reasons allowed) - Discussions *bool `yaml:"discussions,omitempty"` // When false, excludes discussions:write permission. Default (nil or true) includes discussions:write for GitHub Apps with Discussions permission. + Issues *bool `yaml:"issues,omitempty"` // When false, excludes issues:write permission and issues from event condition. Default (nil or true) includes issues:write. + PullRequests *bool `yaml:"pull-requests,omitempty"` // When false, excludes pull-requests:write permission and PRs from event condition. Default (nil or true) includes pull-requests:write. + Discussions *bool `yaml:"discussions,omitempty"` // When true, includes discussions:write permission and discussions in event condition. Default (nil or false) excludes discussions:write. } // buildCreateOutputAddCommentJob creates the add_comment job @@ -91,14 +93,20 @@ func (c *Compiler) buildCreateOutputAddCommentJob(data *WorkflowData, mainJobNam // Build job condition with event check if target is not specified jobCondition := BuildSafeOutputType("add_comment") if data.SafeOutputs.AddComments != nil && data.SafeOutputs.AddComments.Target == "" { - eventCondition := BuildOr( - BuildOr( - BuildPropertyAccess("github.event.issue.number"), - BuildPropertyAccess("github.event.pull_request.number"), - ), - BuildPropertyAccess("github.event.discussion.number"), - ) - jobCondition = BuildAnd(jobCondition, eventCondition) + var eventTerms []ConditionNode + if data.SafeOutputs.AddComments.Issues == nil || *data.SafeOutputs.AddComments.Issues { + eventTerms = append(eventTerms, BuildPropertyAccess("github.event.issue.number")) + } + if data.SafeOutputs.AddComments.PullRequests == nil || *data.SafeOutputs.AddComments.PullRequests { + eventTerms = append(eventTerms, BuildPropertyAccess("github.event.pull_request.number")) + } + if data.SafeOutputs.AddComments.Discussions != nil && *data.SafeOutputs.AddComments.Discussions { + eventTerms = append(eventTerms, BuildPropertyAccess("github.event.discussion.number")) + } + if len(eventTerms) > 0 { + eventCondition := &DisjunctionNode{Terms: eventTerms} + jobCondition = BuildAnd(jobCondition, eventCondition) + } } // Build the needs list - always depend on mainJobName, and conditionally on the other jobs @@ -113,15 +121,11 @@ func (c *Compiler) buildCreateOutputAddCommentJob(data *WorkflowData, mainJobNam needs = append(needs, createPullRequestJobName) } - // Determine permissions based on discussions field - // Default (nil or true) includes discussions:write for GitHub Apps with Discussions permission - // Note: PR comments are issue comments, so only issues:write is needed, not pull_requests:write - var permissions *Permissions - if data.SafeOutputs.AddComments.Discussions != nil && !*data.SafeOutputs.AddComments.Discussions { - permissions = NewPermissionsContentsReadIssuesWrite() - } else { - permissions = NewPermissionsContentsReadIssuesWriteDiscussionsWrite() - } + // Determine permissions based on Issues, PullRequests, and Discussions fields. + // Issues: nil or true → issues:write (default: true) + // PullRequests: nil or true → pull-requests:write (default: true) + // Discussions: explicitly true → discussions:write (default: false) + permissions := buildAddCommentPermissions(data.SafeOutputs.AddComments) // Use the shared builder function to create the job return c.buildSafeOutputJob(data, SafeOutputJobConfig{ @@ -191,3 +195,23 @@ func (c *Compiler) parseCommentsConfig(outputMap map[string]any) *AddCommentsCon return &config } + +// buildAddCommentPermissions computes the permissions for the add_comment job based on config. +// Issues: nil or true → issues:write (default: true) +// PullRequests: nil or true → pull-requests:write (default: true) +// Discussions: explicitly true → discussions:write (default: false) +func buildAddCommentPermissions(config *AddCommentsConfig) *Permissions { + permMap := map[PermissionScope]PermissionLevel{ + PermissionContents: PermissionRead, + } + if config == nil || config.Issues == nil || *config.Issues { + permMap[PermissionIssues] = PermissionWrite + } + if config == nil || config.PullRequests == nil || *config.PullRequests { + permMap[PermissionPullRequests] = PermissionWrite + } + if config != nil && config.Discussions != nil && *config.Discussions { + permMap[PermissionDiscussions] = PermissionWrite + } + return NewPermissionsFromMap(permMap) +} diff --git a/pkg/workflow/safe_outputs_permissions.go b/pkg/workflow/safe_outputs_permissions.go index 3d2610deb5c..a5d6114e483 100644 --- a/pkg/workflow/safe_outputs_permissions.go +++ b/pkg/workflow/safe_outputs_permissions.go @@ -30,14 +30,7 @@ func ComputePermissionsForSafeOutputs(safeOutputs *SafeOutputsConfig) *Permissio } if safeOutputs.AddComments != nil { safeOutputsPermissionsLog.Print("Adding permissions for add-comment") - // Check if discussions permission should be excluded (discussions: false) - // Default (nil or true) includes discussions:write for GitHub Apps with Discussions permission - // Note: PR comments are issue comments, so only issues:write is needed, not pull_requests:write - if safeOutputs.AddComments.Discussions != nil && !*safeOutputs.AddComments.Discussions { - permissions.Merge(NewPermissionsContentsReadIssuesWrite()) - } else { - permissions.Merge(NewPermissionsContentsReadIssuesWriteDiscussionsWrite()) - } + permissions.Merge(buildAddCommentPermissions(safeOutputs.AddComments)) } if safeOutputs.CloseIssues != nil { safeOutputsPermissionsLog.Print("Adding permissions for close-issue") diff --git a/pkg/workflow/safe_outputs_permissions_test.go b/pkg/workflow/safe_outputs_permissions_test.go index a1da8d8c12a..2b73cde5ee3 100644 --- a/pkg/workflow/safe_outputs_permissions_test.go +++ b/pkg/workflow/safe_outputs_permissions_test.go @@ -72,16 +72,31 @@ func TestComputePermissionsForSafeOutputs(t *testing.T) { }, }, { - name: "add-comment default - includes discussions permission", + name: "add-comment default - includes pull-requests, excludes discussions", safeOutputs: &SafeOutputsConfig{ AddComments: &AddCommentsConfig{ BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("1")}, }, }, expected: map[PermissionScope]PermissionLevel{ - PermissionContents: PermissionRead, - PermissionIssues: PermissionWrite, - PermissionDiscussions: PermissionWrite, + PermissionContents: PermissionRead, + PermissionIssues: PermissionWrite, + PermissionPullRequests: PermissionWrite, + }, + }, + { + name: "add-comment with discussions:true - includes discussions permission", + safeOutputs: &SafeOutputsConfig{ + AddComments: &AddCommentsConfig{ + BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("1")}, + Discussions: ptrBool(true), + }, + }, + expected: map[PermissionScope]PermissionLevel{ + PermissionContents: PermissionRead, + PermissionIssues: PermissionWrite, + PermissionPullRequests: PermissionWrite, + PermissionDiscussions: PermissionWrite, }, }, { @@ -92,11 +107,38 @@ func TestComputePermissionsForSafeOutputs(t *testing.T) { Discussions: ptrBool(false), }, }, + expected: map[PermissionScope]PermissionLevel{ + PermissionContents: PermissionRead, + PermissionIssues: PermissionWrite, + PermissionPullRequests: PermissionWrite, + }, + }, + { + name: "add-comment with pull-requests:false - no pull-requests permission", + safeOutputs: &SafeOutputsConfig{ + AddComments: &AddCommentsConfig{ + BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("1")}, + PullRequests: ptrBool(false), + }, + }, expected: map[PermissionScope]PermissionLevel{ PermissionContents: PermissionRead, PermissionIssues: PermissionWrite, }, }, + { + name: "add-comment with issues:false - no issues permission", + safeOutputs: &SafeOutputsConfig{ + AddComments: &AddCommentsConfig{ + BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("1")}, + Issues: ptrBool(false), + }, + }, + expected: map[PermissionScope]PermissionLevel{ + PermissionContents: PermissionRead, + PermissionPullRequests: PermissionWrite, + }, + }, { name: "hide-comment default - includes discussions permission", safeOutputs: &SafeOutputsConfig{ From 38ab34435fb7c33057d7a1935f21e490ba350e82 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Wed, 25 Feb 2026 12:26:45 +0000 Subject: [PATCH 3/3] fix: enable discussions:write by default for add-comment MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Change discussions default from false back to true (nil = true). Now all three target types default to true: - issues: nil or true → issues:write - pull-requests: nil or true → pull-requests:write - discussions: nil or true → discussions:write Set any field to false to opt out of that permission/event condition. Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> --- .github/workflows/archie.lock.yml | 2 ++ .github/workflows/brave.lock.yml | 2 ++ .github/workflows/ci-doctor.lock.yml | 2 ++ .github/workflows/cloclo.lock.yml | 2 ++ .github/workflows/contribution-check.lock.yml | 2 ++ .github/workflows/craft.lock.yml | 2 ++ .github/workflows/daily-assign-issue-to-user.lock.yml | 2 ++ .github/workflows/daily-cli-performance.lock.yml | 2 ++ .github/workflows/daily-fact.lock.yml | 2 ++ .github/workflows/dev-hawk.lock.yml | 2 ++ .github/workflows/discussion-task-miner.lock.yml | 2 ++ .github/workflows/draft-pr-cleanup.lock.yml | 2 ++ .github/workflows/issue-monster.lock.yml | 2 ++ .github/workflows/issue-triage-agent.lock.yml | 2 ++ .github/workflows/pr-triage-agent.lock.yml | 2 ++ .github/workflows/q.lock.yml | 2 ++ .github/workflows/refiner.lock.yml | 2 ++ .github/workflows/scout.lock.yml | 2 ++ .github/workflows/smoke-agent.lock.yml | 2 ++ .github/workflows/smoke-claude.lock.yml | 2 ++ .github/workflows/smoke-gemini.lock.yml | 2 ++ .github/workflows/smoke-multi-pr.lock.yml | 2 ++ .github/workflows/smoke-project.lock.yml | 2 ++ .github/workflows/smoke-temporary-id.lock.yml | 2 ++ .github/workflows/smoke-test-tools.lock.yml | 2 ++ .github/workflows/sub-issue-closer.lock.yml | 2 ++ .github/workflows/technical-doc-writer.lock.yml | 2 ++ .github/workflows/unbloat-docs.lock.yml | 2 ++ .github/workflows/workflow-health-manager.lock.yml | 2 ++ pkg/parser/schemas/main_workflow_schema.json | 2 +- pkg/workflow/add_comment.go | 10 +++++----- pkg/workflow/safe_outputs_permissions_test.go | 9 ++++++--- 32 files changed, 70 insertions(+), 9 deletions(-) diff --git a/.github/workflows/archie.lock.yml b/.github/workflows/archie.lock.yml index d99b1de2bd7..d3e209f4f81 100644 --- a/.github/workflows/archie.lock.yml +++ b/.github/workflows/archie.lock.yml @@ -980,6 +980,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + discussions: write issues: write pull-requests: write outputs: @@ -1143,6 +1144,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + discussions: write issues: write pull-requests: write timeout-minutes: 15 diff --git a/.github/workflows/brave.lock.yml b/.github/workflows/brave.lock.yml index 8c4ad9b990f..43d127fb16f 100644 --- a/.github/workflows/brave.lock.yml +++ b/.github/workflows/brave.lock.yml @@ -968,6 +968,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + discussions: write issues: write pull-requests: write outputs: @@ -1128,6 +1129,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + discussions: write issues: write pull-requests: write timeout-minutes: 15 diff --git a/.github/workflows/ci-doctor.lock.yml b/.github/workflows/ci-doctor.lock.yml index c83ecf99c0c..2b5df580d62 100644 --- a/.github/workflows/ci-doctor.lock.yml +++ b/.github/workflows/ci-doctor.lock.yml @@ -1175,6 +1175,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + discussions: write issues: write pull-requests: write outputs: @@ -1326,6 +1327,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + discussions: write issues: write pull-requests: write timeout-minutes: 15 diff --git a/.github/workflows/cloclo.lock.yml b/.github/workflows/cloclo.lock.yml index f31e50ecb2d..ef5585a2d24 100644 --- a/.github/workflows/cloclo.lock.yml +++ b/.github/workflows/cloclo.lock.yml @@ -1323,6 +1323,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: write + discussions: write issues: write pull-requests: write outputs: @@ -1514,6 +1515,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: write + discussions: write issues: write pull-requests: write timeout-minutes: 15 diff --git a/.github/workflows/contribution-check.lock.yml b/.github/workflows/contribution-check.lock.yml index a664b8f7e01..dc29766a7ea 100644 --- a/.github/workflows/contribution-check.lock.yml +++ b/.github/workflows/contribution-check.lock.yml @@ -1019,6 +1019,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + discussions: write issues: write pull-requests: write outputs: @@ -1117,6 +1118,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + discussions: write issues: write pull-requests: write timeout-minutes: 15 diff --git a/.github/workflows/craft.lock.yml b/.github/workflows/craft.lock.yml index 54591b11821..33b4f859820 100644 --- a/.github/workflows/craft.lock.yml +++ b/.github/workflows/craft.lock.yml @@ -1003,6 +1003,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: write + discussions: write issues: write pull-requests: write outputs: @@ -1166,6 +1167,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: write + discussions: write issues: write pull-requests: write timeout-minutes: 15 diff --git a/.github/workflows/daily-assign-issue-to-user.lock.yml b/.github/workflows/daily-assign-issue-to-user.lock.yml index 779f6d42654..c858e63a408 100644 --- a/.github/workflows/daily-assign-issue-to-user.lock.yml +++ b/.github/workflows/daily-assign-issue-to-user.lock.yml @@ -962,6 +962,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + discussions: write issues: write pull-requests: write outputs: @@ -1060,6 +1061,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + discussions: write issues: write pull-requests: write timeout-minutes: 15 diff --git a/.github/workflows/daily-cli-performance.lock.yml b/.github/workflows/daily-cli-performance.lock.yml index 86a00085284..628b78fdf69 100644 --- a/.github/workflows/daily-cli-performance.lock.yml +++ b/.github/workflows/daily-cli-performance.lock.yml @@ -1176,6 +1176,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + discussions: write issues: write pull-requests: write outputs: @@ -1347,6 +1348,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + discussions: write issues: write pull-requests: write timeout-minutes: 15 diff --git a/.github/workflows/daily-fact.lock.yml b/.github/workflows/daily-fact.lock.yml index 57e20637a6e..14b06244a08 100644 --- a/.github/workflows/daily-fact.lock.yml +++ b/.github/workflows/daily-fact.lock.yml @@ -890,6 +890,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + discussions: write issues: write pull-requests: write outputs: @@ -987,6 +988,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + discussions: write issues: write pull-requests: write timeout-minutes: 15 diff --git a/.github/workflows/dev-hawk.lock.yml b/.github/workflows/dev-hawk.lock.yml index ae8e6d9f30f..8fe63277aca 100644 --- a/.github/workflows/dev-hawk.lock.yml +++ b/.github/workflows/dev-hawk.lock.yml @@ -1030,6 +1030,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + discussions: write issues: write pull-requests: write outputs: @@ -1161,6 +1162,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + discussions: write issues: write pull-requests: write timeout-minutes: 15 diff --git a/.github/workflows/discussion-task-miner.lock.yml b/.github/workflows/discussion-task-miner.lock.yml index 55443717cd2..e4720bff617 100644 --- a/.github/workflows/discussion-task-miner.lock.yml +++ b/.github/workflows/discussion-task-miner.lock.yml @@ -1051,6 +1051,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + discussions: write issues: write pull-requests: write outputs: @@ -1223,6 +1224,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + discussions: write issues: write pull-requests: write timeout-minutes: 15 diff --git a/.github/workflows/draft-pr-cleanup.lock.yml b/.github/workflows/draft-pr-cleanup.lock.yml index 60b5f0f0cbd..eaa22c624fc 100644 --- a/.github/workflows/draft-pr-cleanup.lock.yml +++ b/.github/workflows/draft-pr-cleanup.lock.yml @@ -991,6 +991,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + discussions: write issues: write pull-requests: write outputs: @@ -1090,6 +1091,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + discussions: write issues: write pull-requests: write timeout-minutes: 15 diff --git a/.github/workflows/issue-monster.lock.yml b/.github/workflows/issue-monster.lock.yml index c5606b352db..6a1d6f49ecc 100644 --- a/.github/workflows/issue-monster.lock.yml +++ b/.github/workflows/issue-monster.lock.yml @@ -992,6 +992,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + discussions: write issues: write pull-requests: write outputs: @@ -1150,6 +1151,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + discussions: write issues: write pull-requests: write timeout-minutes: 15 diff --git a/.github/workflows/issue-triage-agent.lock.yml b/.github/workflows/issue-triage-agent.lock.yml index 05af309a1e5..511cd22cdcb 100644 --- a/.github/workflows/issue-triage-agent.lock.yml +++ b/.github/workflows/issue-triage-agent.lock.yml @@ -932,6 +932,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + discussions: write issues: write pull-requests: write outputs: @@ -1029,6 +1030,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + discussions: write issues: write pull-requests: write timeout-minutes: 15 diff --git a/.github/workflows/pr-triage-agent.lock.yml b/.github/workflows/pr-triage-agent.lock.yml index bd4ce70c683..d668917b7b8 100644 --- a/.github/workflows/pr-triage-agent.lock.yml +++ b/.github/workflows/pr-triage-agent.lock.yml @@ -1056,6 +1056,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + discussions: write issues: write pull-requests: write outputs: @@ -1224,6 +1225,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + discussions: write issues: write pull-requests: write timeout-minutes: 15 diff --git a/.github/workflows/q.lock.yml b/.github/workflows/q.lock.yml index b19f3f6dfb1..c959d7f0f85 100644 --- a/.github/workflows/q.lock.yml +++ b/.github/workflows/q.lock.yml @@ -1174,6 +1174,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: write + discussions: write issues: write pull-requests: write outputs: @@ -1365,6 +1366,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: write + discussions: write issues: write pull-requests: write timeout-minutes: 15 diff --git a/.github/workflows/refiner.lock.yml b/.github/workflows/refiner.lock.yml index 32a76d6f14d..caa98adb73f 100644 --- a/.github/workflows/refiner.lock.yml +++ b/.github/workflows/refiner.lock.yml @@ -1018,6 +1018,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: write + discussions: write issues: write pull-requests: write outputs: @@ -1169,6 +1170,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: write + discussions: write issues: write pull-requests: write timeout-minutes: 15 diff --git a/.github/workflows/scout.lock.yml b/.github/workflows/scout.lock.yml index 1fdb33e70f6..c330cd38ea5 100644 --- a/.github/workflows/scout.lock.yml +++ b/.github/workflows/scout.lock.yml @@ -1163,6 +1163,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + discussions: write issues: write pull-requests: write outputs: @@ -1335,6 +1336,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + discussions: write issues: write pull-requests: write timeout-minutes: 15 diff --git a/.github/workflows/smoke-agent.lock.yml b/.github/workflows/smoke-agent.lock.yml index ce9cd4251fb..6d7c71f6dc7 100644 --- a/.github/workflows/smoke-agent.lock.yml +++ b/.github/workflows/smoke-agent.lock.yml @@ -999,6 +999,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + discussions: write issues: write pull-requests: write outputs: @@ -1153,6 +1154,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + discussions: write issues: write pull-requests: write timeout-minutes: 15 diff --git a/.github/workflows/smoke-claude.lock.yml b/.github/workflows/smoke-claude.lock.yml index a14038238f4..40d3e047a15 100644 --- a/.github/workflows/smoke-claude.lock.yml +++ b/.github/workflows/smoke-claude.lock.yml @@ -2559,6 +2559,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: write + discussions: write issues: write pull-requests: write outputs: @@ -2731,6 +2732,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: write + discussions: write issues: write pull-requests: write timeout-minutes: 15 diff --git a/.github/workflows/smoke-gemini.lock.yml b/.github/workflows/smoke-gemini.lock.yml index d3a3bf3cc08..9bc38f0de45 100644 --- a/.github/workflows/smoke-gemini.lock.yml +++ b/.github/workflows/smoke-gemini.lock.yml @@ -1200,6 +1200,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + discussions: write issues: write pull-requests: write outputs: @@ -1368,6 +1369,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + discussions: write issues: write pull-requests: write timeout-minutes: 15 diff --git a/.github/workflows/smoke-multi-pr.lock.yml b/.github/workflows/smoke-multi-pr.lock.yml index 694f3e1fb2f..10dc1028964 100644 --- a/.github/workflows/smoke-multi-pr.lock.yml +++ b/.github/workflows/smoke-multi-pr.lock.yml @@ -1050,6 +1050,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: write + discussions: write issues: write pull-requests: write outputs: @@ -1236,6 +1237,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: write + discussions: write issues: write pull-requests: write timeout-minutes: 15 diff --git a/.github/workflows/smoke-project.lock.yml b/.github/workflows/smoke-project.lock.yml index 27f402ed6ae..7d2e6e98d25 100644 --- a/.github/workflows/smoke-project.lock.yml +++ b/.github/workflows/smoke-project.lock.yml @@ -1443,6 +1443,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: write + discussions: write issues: write pull-requests: write outputs: @@ -1629,6 +1630,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: write + discussions: write issues: write pull-requests: write timeout-minutes: 15 diff --git a/.github/workflows/smoke-temporary-id.lock.yml b/.github/workflows/smoke-temporary-id.lock.yml index 84b5b3cbaa4..02b17bef95b 100644 --- a/.github/workflows/smoke-temporary-id.lock.yml +++ b/.github/workflows/smoke-temporary-id.lock.yml @@ -1066,6 +1066,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + discussions: write issues: write pull-requests: write outputs: @@ -1234,6 +1235,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + discussions: write issues: write pull-requests: write timeout-minutes: 15 diff --git a/.github/workflows/smoke-test-tools.lock.yml b/.github/workflows/smoke-test-tools.lock.yml index 640db9e7ec5..192053fddbb 100644 --- a/.github/workflows/smoke-test-tools.lock.yml +++ b/.github/workflows/smoke-test-tools.lock.yml @@ -969,6 +969,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + discussions: write issues: write pull-requests: write outputs: @@ -1121,6 +1122,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + discussions: write issues: write pull-requests: write timeout-minutes: 15 diff --git a/.github/workflows/sub-issue-closer.lock.yml b/.github/workflows/sub-issue-closer.lock.yml index 7f2da71db74..2fa90039c55 100644 --- a/.github/workflows/sub-issue-closer.lock.yml +++ b/.github/workflows/sub-issue-closer.lock.yml @@ -1028,6 +1028,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + discussions: write issues: write pull-requests: write outputs: @@ -1126,6 +1127,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + discussions: write issues: write pull-requests: write timeout-minutes: 15 diff --git a/.github/workflows/technical-doc-writer.lock.yml b/.github/workflows/technical-doc-writer.lock.yml index 44df9bfbdb9..84f8309cdfa 100644 --- a/.github/workflows/technical-doc-writer.lock.yml +++ b/.github/workflows/technical-doc-writer.lock.yml @@ -1098,6 +1098,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: write + discussions: write issues: write pull-requests: write outputs: @@ -1215,6 +1216,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: write + discussions: write issues: write pull-requests: write timeout-minutes: 15 diff --git a/.github/workflows/unbloat-docs.lock.yml b/.github/workflows/unbloat-docs.lock.yml index b48525fac45..2a2253d6e86 100644 --- a/.github/workflows/unbloat-docs.lock.yml +++ b/.github/workflows/unbloat-docs.lock.yml @@ -1253,6 +1253,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: write + discussions: write issues: write pull-requests: write outputs: @@ -1431,6 +1432,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: write + discussions: write issues: write pull-requests: write timeout-minutes: 15 diff --git a/.github/workflows/workflow-health-manager.lock.yml b/.github/workflows/workflow-health-manager.lock.yml index d05193b3baa..b4a48688ca7 100644 --- a/.github/workflows/workflow-health-manager.lock.yml +++ b/.github/workflows/workflow-health-manager.lock.yml @@ -1145,6 +1145,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + discussions: write issues: write pull-requests: write outputs: @@ -1343,6 +1344,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + discussions: write issues: write pull-requests: write timeout-minutes: 15 diff --git a/pkg/parser/schemas/main_workflow_schema.json b/pkg/parser/schemas/main_workflow_schema.json index f5e92e03633..9ef729733dc 100644 --- a/pkg/parser/schemas/main_workflow_schema.json +++ b/pkg/parser/schemas/main_workflow_schema.json @@ -5023,7 +5023,7 @@ }, "discussions": { "type": "boolean", - "description": "Controls whether the workflow requests discussions:write permission for add-comment and includes discussions in the event trigger condition. Default: false (excludes discussions:write). Set to true if you want the agent to comment on discussions." + "description": "Controls whether the workflow requests discussions:write permission for add-comment and includes discussions in the event trigger condition. Default: true (includes discussions:write). Set to false if your GitHub App lacks Discussions permission to prevent 422 errors during token generation." }, "issues": { "type": "boolean", diff --git a/pkg/workflow/add_comment.go b/pkg/workflow/add_comment.go index 9e4ce590b5d..604aabb5832 100644 --- a/pkg/workflow/add_comment.go +++ b/pkg/workflow/add_comment.go @@ -26,7 +26,7 @@ type AddCommentsConfig struct { AllowedReasons []string `yaml:"allowed-reasons,omitempty"` // List of allowed reasons for hiding older comments (default: all reasons allowed) Issues *bool `yaml:"issues,omitempty"` // When false, excludes issues:write permission and issues from event condition. Default (nil or true) includes issues:write. PullRequests *bool `yaml:"pull-requests,omitempty"` // When false, excludes pull-requests:write permission and PRs from event condition. Default (nil or true) includes pull-requests:write. - Discussions *bool `yaml:"discussions,omitempty"` // When true, includes discussions:write permission and discussions in event condition. Default (nil or false) excludes discussions:write. + Discussions *bool `yaml:"discussions,omitempty"` // When false, excludes discussions:write permission and discussions from event condition. Default (nil or true) includes discussions:write. } // buildCreateOutputAddCommentJob creates the add_comment job @@ -100,7 +100,7 @@ func (c *Compiler) buildCreateOutputAddCommentJob(data *WorkflowData, mainJobNam if data.SafeOutputs.AddComments.PullRequests == nil || *data.SafeOutputs.AddComments.PullRequests { eventTerms = append(eventTerms, BuildPropertyAccess("github.event.pull_request.number")) } - if data.SafeOutputs.AddComments.Discussions != nil && *data.SafeOutputs.AddComments.Discussions { + if data.SafeOutputs.AddComments.Discussions == nil || *data.SafeOutputs.AddComments.Discussions { eventTerms = append(eventTerms, BuildPropertyAccess("github.event.discussion.number")) } if len(eventTerms) > 0 { @@ -124,7 +124,7 @@ func (c *Compiler) buildCreateOutputAddCommentJob(data *WorkflowData, mainJobNam // Determine permissions based on Issues, PullRequests, and Discussions fields. // Issues: nil or true → issues:write (default: true) // PullRequests: nil or true → pull-requests:write (default: true) - // Discussions: explicitly true → discussions:write (default: false) + // Discussions: nil or true → discussions:write (default: true) permissions := buildAddCommentPermissions(data.SafeOutputs.AddComments) // Use the shared builder function to create the job @@ -199,7 +199,7 @@ func (c *Compiler) parseCommentsConfig(outputMap map[string]any) *AddCommentsCon // buildAddCommentPermissions computes the permissions for the add_comment job based on config. // Issues: nil or true → issues:write (default: true) // PullRequests: nil or true → pull-requests:write (default: true) -// Discussions: explicitly true → discussions:write (default: false) +// Discussions: nil or true → discussions:write (default: true) func buildAddCommentPermissions(config *AddCommentsConfig) *Permissions { permMap := map[PermissionScope]PermissionLevel{ PermissionContents: PermissionRead, @@ -210,7 +210,7 @@ func buildAddCommentPermissions(config *AddCommentsConfig) *Permissions { if config == nil || config.PullRequests == nil || *config.PullRequests { permMap[PermissionPullRequests] = PermissionWrite } - if config != nil && config.Discussions != nil && *config.Discussions { + if config == nil || config.Discussions == nil || *config.Discussions { permMap[PermissionDiscussions] = PermissionWrite } return NewPermissionsFromMap(permMap) diff --git a/pkg/workflow/safe_outputs_permissions_test.go b/pkg/workflow/safe_outputs_permissions_test.go index 2b73cde5ee3..4ba92b5af70 100644 --- a/pkg/workflow/safe_outputs_permissions_test.go +++ b/pkg/workflow/safe_outputs_permissions_test.go @@ -72,7 +72,7 @@ func TestComputePermissionsForSafeOutputs(t *testing.T) { }, }, { - name: "add-comment default - includes pull-requests, excludes discussions", + name: "add-comment default - includes pull-requests and discussions", safeOutputs: &SafeOutputsConfig{ AddComments: &AddCommentsConfig{ BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("1")}, @@ -82,6 +82,7 @@ func TestComputePermissionsForSafeOutputs(t *testing.T) { PermissionContents: PermissionRead, PermissionIssues: PermissionWrite, PermissionPullRequests: PermissionWrite, + PermissionDiscussions: PermissionWrite, }, }, { @@ -122,8 +123,9 @@ func TestComputePermissionsForSafeOutputs(t *testing.T) { }, }, expected: map[PermissionScope]PermissionLevel{ - PermissionContents: PermissionRead, - PermissionIssues: PermissionWrite, + PermissionContents: PermissionRead, + PermissionIssues: PermissionWrite, + PermissionDiscussions: PermissionWrite, }, }, { @@ -137,6 +139,7 @@ func TestComputePermissionsForSafeOutputs(t *testing.T) { expected: map[PermissionScope]PermissionLevel{ PermissionContents: PermissionRead, PermissionPullRequests: PermissionWrite, + PermissionDiscussions: PermissionWrite, }, }, {