Remove unnecessary `contents: read` from safe-output handlers - #48913

Merged

pelikhan merged 14 commits into

mainfrom

copilot/why-safe-outputs-require-contents-read

Jul 29, 2026

Commits on Jul 29, 2026

Initial plan
Copilot
authored
c00f1ce
Remove unnecessary contents:read from safe-output handlers

Copilot
and
pelikhan
authored
7778399
docs(adr): draft ADR-48913 for removing contents:read from output-only safe-output handlers

github-actions[bot]
and
claude
authored
24c0218
Merge branch 'main' into copilot/why-safe-outputs-require-contents-read
pelikhan
authored
7d879ee
fix: address review feedback on safe-output permissions

Copilot
and
pelikhan
authored
907d15e
Merge branch 'main' into copilot/why-safe-outputs-require-contents-read
pelikhan
authored
eca5beb
test: add minimal permission tests for create-check-run, create-project-status-update, merge-pull-request, update-release, and create-agent-session handlers; fix spec note for create_project_status…

Copilot
and
pelikhan
authored
11c8323
Merge branch 'main' into copilot/why-safe-outputs-require-contents-read
pelikhan
authored
88987da
chore: recompile workflow lock files

Copilot
and
pelikhan
authored
10a13c7
Merge branch 'main' into copilot/why-safe-outputs-require-contents-read
pelikhan
authored
d747a4a
Merge branch 'main' into copilot/why-safe-outputs-require-contents-read
pelikhan
authored
32829de
fix: update TestDailyAgentOfTheDayBlogWriterHasGitDenialMitigationAllowlist to match bash: [\"*\"] wildcard

Copilot
and
pelikhan
authored
e310068
Merge branch 'main' into copilot/why-safe-outputs-require-contents-read
pelikhan
authored
def1266
Merge branch 'main' into copilot/why-safe-outputs-require-contents-read
pelikhan
authored
1aaac95

Navigation Menu

Uh oh!

Remove unnecessary `contents: read` from safe-output handlers - #48913

Remove unnecessary `contents: read` from safe-output handlers#48913
pelikhan merged 14 commits into
mainfrom
copilot/why-safe-outputs-require-contents-read

Commits on Jul 29, 2026

Initial plan

Remove unnecessary contents:read from safe-output handlers

docs(adr): draft ADR-48913 for removing contents:read from output-only safe-output handlers

Merge branch 'main' into copilot/why-safe-outputs-require-contents-read

fix: address review feedback on safe-output permissions

Merge branch 'main' into copilot/why-safe-outputs-require-contents-read

test: add minimal permission tests for create-check-run, create-project-status-update, merge-pull-request, update-release, and create-agent-session handlers; fix spec note for create_project_status…

Merge branch 'main' into copilot/why-safe-outputs-require-contents-read

chore: recompile workflow lock files

Merge branch 'main' into copilot/why-safe-outputs-require-contents-read

Merge branch 'main' into copilot/why-safe-outputs-require-contents-read

fix: update TestDailyAgentOfTheDayBlogWriterHasGitDenialMitigationAllowlist to match bash: [\"*\"] wildcard

Merge branch 'main' into copilot/why-safe-outputs-require-contents-read

Merge branch 'main' into copilot/why-safe-outputs-require-contents-read