Skip to content

Fix TYPE-008 conformance checker permission expectations #49324

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
pelikhan merged 4 commits into from
Jul 31, 2026
+2 −22
Merged

Fix TYPE-008 conformance checker permission expectations #49324

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
2e04308
Initial plan
Copilot Jul 31, 2026
bc10fde
Fix TYPE-008 safe outputs conformance check
Copilot Jul 31, 2026
fa05373
Merge branch 'main' into copilot/type-008-fix-stale-permission-names
github-actions[bot] Jul 31, 2026
f2e80d3
Fix TYPE-008 substring match: use NewPermissionsChecksWrite() with pa…
Copilot Jul 31, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 0 additions & 2 deletions pkg/workflow/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1479,8 +1479,6 @@ This appendix is generated from the current non-test Go source files in this pac
| `permissions_factory.go` | `NewPermissionsActionsWrite` | `func NewPermissionsActionsWrite() *Permissions` | NewPermissionsActionsWrite creates permissions with actions: write This is required for dispatching workflows via workflow_dispatch |
| `permissions_factory.go` | `NewPermissionsAllRead` | `func NewPermissionsAllRead() *Permissions` | NewPermissionsAllRead creates a Permissions with all: read |
| `permissions_factory.go` | `NewPermissionsContentsRead` | `func NewPermissionsContentsRead() *Permissions` | NewPermissionsContentsRead creates permissions with contents: read |
| `permissions_factory.go` | `NewPermissionsContentsReadChecksWrite` | `func NewPermissionsContentsReadChecksWrite() *Permissions` | NewPermissionsContentsReadChecksWrite creates permissions with contents: read and checks: write |
| `permissions_factory.go` | `NewPermissionsContentsReadChecksWritePRRead` | `func NewPermissionsContentsReadChecksWritePRRead() *Permissions` | NewPermissionsContentsReadChecksWritePRRead creates permissions with contents: read, checks: write, and pull-requests: read Used when create-check-run has a target configured and must resolve the PR head SHA via the RES… |
| `permissions_factory.go` | `NewPermissionsContentsReadIssuesWrite` | `func NewPermissionsContentsReadIssuesWrite() *Permissions` | NewPermissionsContentsReadIssuesWrite creates permissions with contents: read and issues: write |
| `permissions_factory.go` | `NewPermissionsContentsReadIssuesWritePRWrite` | `func NewPermissionsContentsReadIssuesWritePRWrite() *Permissions` | NewPermissionsContentsReadIssuesWritePRWrite creates permissions with contents: read, issues: write, pull-requests: write |
| `permissions_factory.go` | `NewPermissionsContentsReadSecurityEventsWriteActionsRead` | `func NewPermissionsContentsReadSecurityEventsWriteActionsRead() *Permissions` | NewPermissionsContentsReadSecurityEventsWriteActionsRead creates permissions with contents: read, security-events: write, actions: read |
Expand Down
18 changes: 0 additions & 18 deletions pkg/workflow/permissions_factory.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -166,24 +166,6 @@ func NewPermissionsContentsReadSecurityEventsWriteActionsRead() *Permissions {
})
}

// NewPermissionsContentsReadChecksWrite creates permissions with contents: read and checks: write
func NewPermissionsContentsReadChecksWrite() *Permissions {
return NewPermissionsFromMap(map[PermissionScope]PermissionLevel{
PermissionContents: PermissionRead,
PermissionChecks: PermissionWrite,
})
}

// NewPermissionsContentsReadChecksWritePRRead creates permissions with contents: read, checks: write, and pull-requests: read
// Used when create-check-run has a target configured and must resolve the PR head SHA via the REST API
func NewPermissionsContentsReadChecksWritePRRead() *Permissions {
return NewPermissionsFromMap(map[PermissionScope]PermissionLevel{
PermissionContents: PermissionRead,
PermissionChecks: PermissionWrite,
PermissionPullRequests: PermissionRead,
})
}

// Clone returns a deep copy of the Permissions object. The clone shares no underlying
// state with the original, so callers can safely call Set() on the clone without
// affecting the original (e.g. when reusing CachedPermissions).
Expand Down
4 changes: 2 additions & 2 deletions scripts/check-safe-outputs-conformance.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1622,11 +1622,11 @@ check_create_check_run_handler() {
# Per spec Section 7.3 dual-permission profile: checks:write without target,
# adds pull-requests:read when target is configured.
if [ -f "$handler_registry" ]; then
if ! grep -q "NewPermissionsContentsReadChecksWrite" "$handler_registry"; then
if ! grep -q "NewPermissionsChecksWrite()" "$handler_registry"; then
log_critical "TYPE-008: create_check_run dual-permission profile missing checks:write base permission (Section 7.3 v1.23.0)"
failed=1
fi
if ! grep -q "NewPermissionsContentsReadChecksWritePRRead" "$handler_registry"; then
if ! grep -q "NewPermissionsChecksWritePRRead" "$handler_registry"; then
log_high "TYPE-008: create_check_run dual-permission profile missing pull-requests:read when target configured (Section 7.3 v1.23.0)"
failed=1
fi
Expand Down
Loading