Skip to content

fix: move permission computation to dedicated safe_outputs_permissions.go#20270

Merged
pelikhan merged 2 commits intomainfrom
copilot/add-safe-outputs-permission-file
Mar 10, 2026
Merged

fix: move permission computation to dedicated safe_outputs_permissions.go#20270
pelikhan merged 2 commits intomainfrom
copilot/add-safe-outputs-permission-file

Conversation

Copy link
Contributor

Copilot AI commented Mar 9, 2026

The Safe Outputs conformance check IMP-002 requires pkg/workflow/safe_outputs_permissions.go to exist with ComputePermissionsForSafeOutputs defined in it. The function was fully implemented but lived in safe_outputs_jobs.go, causing the conformance check to fail.

Changes

  • New file: pkg/workflow/safe_outputs_permissions.go — extracted from safe_outputs_jobs.go:
    • safeOutputsPermissionsLog
    • oidcVaultActions + stepsRequireIDToken()
    • ComputePermissionsForSafeOutputs() — computes minimum required GitHub token permissions from a *SafeOutputsConfig
    • SafeOutputsConfigFromKeys() — builds a minimal SafeOutputsConfig from key names for permission computation
  • safe_outputs_jobs.go: removed the above declarations and dropped the now-unused slices import

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

  • https://api.github.com/graphql
    • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw nonexistent-workauth --limit git rev-�� --show-toplevel x_amd64/vet /usr/bin/git -json GO111MODULE 64/bin/go git (http block)
    • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw GO111MODULE 64/bin/go git rev-�� --git-dir go /usr/bin/gh -json GO111MODULE 64/bin/go gh (http block)
  • https://api.github.com/repos/actions/ai-inference/git/ref/tags/v1
    • Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq .object.sha --show-toplevel ache/go/1.25.0/xGO111MODULE /usr/bin/git 6687369/b420/_pkgit GO111MODULE 64/bin/go git init�� GOMODCACHE resolved$ /usr/bin/git FlyM/0GZUz1jkbSHgit GO111MODULE 64/bin/go git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq .object.sha --show-toplevel node /opt/hostedtoolcache/node/24.14.0/x64/bin/node prettier --write 64/bin/go node /tmp�� /home/REDACTED/work/gh-aw/gh-aw/.github/workflows/ai-moderator.md go /usr/bin/git -json GO111MODULE 64/bin/go git (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v3
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq .object.sha runs/20260309-223941-31848/test-3029707102/.github/workflows GO111MODULE ache/node/24.14.0/x64/bin/node l GOMOD GOMODCACHE go t-36�� sistency_GoAndJavaScript482858660/001/test-simple-frontmatter.md GO111MODULE ache/go/1.25.0/x64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE ache/go/1.25.0/x64/pkg/tool/linux_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq .object.sha -json GO111MODULE (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v5
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env plorer.md GO111MODULE x_amd64/link GOINSECURE GOMOD GOMODCACHE x_amd64/link (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha GOMODCACHE sh /usr/bin/git "prettier" --chegit GOPROXY 64/bin/go git conf�� --get remote.origin.url /usr/bin/gh /tmp/go-build393git -trimpath 64/bin/go gh (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha --show-toplevel go /usr/bin/git -json GO111MODULE ache/go/1.25.0/x--show-toplevel git rev-�� --show-toplevel go /usr/bin/git -json GO111MODULE ache/go/1.25.0/x--show-toplevel git (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v6
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha --show-toplevel -tests /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/vet b7505c45f80cd646git GO111MODULE 64/bin/go /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/vet -ato�� -bool -buildtags ache/node/24.14.0/x64/bin/node -errorsas -ifaceassert -nilfunc ache/node/24.14.0/x64/bin/node (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha /tmp/gh-aw-test-runs/20260309-223941-31848/test-3940876394/.github/workflows rev-parse /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/compile ec592ac3a4cb56bfgit GO111MODULE 64/bin/go /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/compile -o /tmp/go-build3765746436/b422/_pkg_.a -trimpath (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha --show-toplevel go /usr/bin/git 3940876394/.githgit GO111MODULE x_amd64/compile git rev-�� --show-toplevel x_amd64/compile /usr/bin/git -json GO111MODULE 64/pkg/tool/linu--show-toplevel git (http block)
  • https://api.github.com/repos/actions/github-script/git/ref/tags/v8
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha GOSUMDB GOWORK 64/bin/go GOINSECURE GOMOD GOMODCACHE go env ck 'scripts/**/*GOINSECURE GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha go1.25.0 -c=4 -nolocalimports -importcfg /tmp/go-build3765746436/b389/importcfg -pack /tmp/go-build3765746436/b389/_testmain.go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD ode-gyp-bin/node-json go env (http block)
  • https://api.github.com/repos/actions/setup-go/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq .object.sha --show-toplevel ortcfg /tmp/go-build3765746436/b416/sliceutil.test g/mathutil/mathugit g/mathutil/mathurev-parse 64/bin/go /tmp/go-build3765746436/b416/sliceutil.test -tes�� -test.paniconexit0 -test.v=true /usr/bin/git -test.timeout=10git -test.run=^Test -test.short=true--show-toplevel git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq .object.sha -test.paniconexit0 -test.timeout=10m0s /usr/bin/infocmp -test.short=truegit go 64/bin/go infocmp -1 xterm-color sh /usr/bin/git npx prettier --wgit go /node git (http block)
  • https://api.github.com/repos/actions/setup-node/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq .object.sha ry=1 config ache/node/24.14.0/x64/bin/node remote.origin.urgit GO111MODULE 64/bin/go /tmp/go-build3765746436/b409/parser.test t-23�� k/gh-aw/gh-aw/.github/workflows/ai-moderator.md -test.v=true /opt/hostedtoolcache/node/24.14.0/x64/bin/node -test.timeout=10git -test.run=^Test -test.short=true--show-toplevel node (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq .object.sha -v sh /usr/bin/gh "prettier" --wrigit go 64/bin/go gh api /repos/actions/github-script/git/ref/tags/v8 --jq ache/node/24.14.0/x64/bin/node npx prettier --wgit go /prettier ache/node/24.14.0/x64/bin/node (http block)
  • https://api.github.com/repos/actions/upload-artifact/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq .object.sha -json GO111MODULE ache/go/1.25.0/x64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE ache/go/1.25.0/x64/pkg/tool/linux_amd64/compile env 5746436/b405/_pkg_.a GO111MODULE 5746436/b405=> GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq .object.sha ck 'scripts/**/*.js' --ignore-path .prettierigno-test.short=true GO111MODULE ache/go/1.25.0/x64/pkg/tool/linux_amd64/link GOINSECURE GOMOD GOMODCACHE ache/go/1.25.0/x64/pkg/tool/linux_amd64/link env 6175366/b387/envutil.test GO111MODULE 6175366/b416/testutil.test GOINSECURE GOMOD s,MFiles,HFiles,--show-toplevel 6175366/b416/testutil.test (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/1/artifacts
    • Triggering command: /usr/bin/gh gh run download 1 --dir test-logs/run-1 GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh run download 1 --dir test-logs/run-1 GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh run download 1 --dir test-logs/run-1 GO111MODULE tions/setup/node_modules/.bin/node GOINSECURE GOMOD GOMODCACHE go tion�� -json GO111MODULE ache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/12345/artifacts
    • Triggering command: /usr/bin/gh gh run download 12345 --dir test-logs/run-12345 GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh run download 12345 --dir test-logs/run-12345 GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh run download 12345 --dir test-logs/run-12345 GO111MODULE tions/setup/js/node_modules/.bin/prettier GOINSECURE GOMOD GOMODCACHE go env epOnly,Imports,ImportMap,TestImports,XTestImpor GO111MODULE Name,path,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/12346/artifacts
    • Triggering command: /usr/bin/gh gh run download 12346 --dir test-logs/run-12346 GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh run download 12346 --dir test-logs/run-12346 GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh run download 12346 --dir test-logs/run-12346 GO111MODULE tions/setup/js/node_modules/.bin/node GOINSECURE GOMOD GOMODCACHE go tion�� 01/test1.md GO111MODULE 64/pkg/tool/linux_amd64/link GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/link (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/2/artifacts
    • Triggering command: /usr/bin/gh gh run download 2 --dir test-logs/run-2 GO111MODULE x_amd64/link GOINSECURE GOMOD GOMODCACHE x_amd64/link env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE wJ/GFtmVa307QDDNuUCuh0B/-q2laYTO-test.v=true (http block)
    • Triggering command: /usr/bin/gh gh run download 2 --dir test-logs/run-2 GO111MODULE x_amd64/link GOINSECURE GOMOD GOMODCACHE x_amd64/link env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh run download 2 --dir test-logs/run-2 GO111MODULE tions/node_modules/.bin/node GOINSECURE GOMOD GOMODCACHE go tion�� -json GO111MODULE ache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/3/artifacts
    • Triggering command: /usr/bin/gh gh run download 3 --dir test-logs/run-3 GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh run download 3 --dir test-logs/run-3 GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh run download 3 --dir test-logs/run-3 GO111MODULE de_modules/.bin/node GOINSECURE GOMOD GOMODCACHE go tion�� -json GO111MODULE ache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/4/artifacts
    • Triggering command: /usr/bin/gh gh run download 4 --dir test-logs/run-4 GO111MODULE x_amd64/link GOINSECURE GOMOD GOMODCACHE x_amd64/link env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE Kt/X5TPudS6vay4Uremote.origin.url (http block)
    • Triggering command: /usr/bin/gh gh run download 4 --dir test-logs/run-4 GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh run download 4 --dir test-logs/run-4 GO111MODULE ules/.bin/node GOINSECURE GOMOD GOMODCACHE go tion�� -json GO111MODULE ache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/5/artifacts
    • Triggering command: /usr/bin/gh gh run download 5 --dir test-logs/run-5 GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh run download 5 --dir test-logs/run-5 GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env (http block)
    • Triggering command: /usr/bin/gh gh run download 5 --dir test-logs/run-5 GO111MODULE bin/node GOINSECURE GOMOD GOMODCACHE go tion�� -json GO111MODULE ndor/bin/bash GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/github/gh-aw/actions/workflows
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE erignore env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path --write **/*.cjs 64/bin/go **/*.json --ignore-path ../../../.prettinpx prettier --check '**/*.cjs' '**/*.ts' '**/*.json' --ignore-path ../../../.pr**/*.json node /hom�� --write scripts/**/*.js 64/bin/go .prettierignore --log-level=erro-c /usr/bin/gh make (http block)
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path "prettier" --wriGOINSECURE go 64/bin/go -json GO111MODULE 64/bin/go sh -c npx prettier --w**/*.ts go 64/bin/go 724718188/.githugo GO111MODULE de_modules/.bin/-e go (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env 1396082223/.github/workflows GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.2.3
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq .object.sha 6687369/b392/_pkGOINSECURE GO111MODULE 64/bin/go GOINSECURE b/gh-aw/pkg/envu-### GOMODCACHE go env dTEj/_5zZ7ABo6YP- GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE 6687369/b392/impconfig (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq .object.sha prettier --write 64/bin/go !../../../pkg/wo/bin/sh --ignore-path ../../../.prettiecho "Syncing actions-lock.json from .github/aw to pkg/workflow/data/action_pins-errorsas go /pre�� -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq .object.sha ath ../../../.pr**/*.json ../../../**/*.js--ignore-path 327f55fad396612b-d --ignore-path ../../../.pretti--norc 0/x64/lib/node_m--noprofile go er -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v2.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq .object.sha 6687369/b393/_pkGOINSECURE GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env PAc1/9GQjYYEAmAeGOSUMDB GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE 6687369/b393/impconfig (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq .object.sha 6687369/b405/_pkGOINSECURE GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env A7AU/ox4tFYGKSvu-errorsas GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE 6687369/b405/imprev-parse (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq .object.sha 6687369/b412/_pkGOINSECURE GO111MODULE 64/bin/go GOINSECURE b/gh-aw/pkg/test-atomic GOMODCACHE go env pAbU/df2Fx0C0xZw-errorsas GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE 6687369/b412/impconfig (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v3.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq .object.sha 6687369/b395/_pkGOINSECURE GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env 2Rpc/EiDXIxkZiZc-errorsas GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE 6687369/b395/imp-tests (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq .object.sha prettier --write 64/bin/go !../../../pkg/wochmod --ignore-path ../../../.prettiactions/setup-cli/install.sh go /pre�� -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq .object.sha ath ../../../.pr**/*.json ../../../**/*.js--ignore-path modules/@npmcli/run-script/lib/node-gyp-bin/node --ignore-path ../../../.pretti-V=full ache/go/1.25.0/x64/bin/go go er -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/nonexistent/action/git/ref/tags/v999.999.999
    • Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/nonexistent/repo/actions/runs/12345
    • Triggering command: /usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion GOINSECURE GOMOD GOMODCACHE go 8d51�� -json GO111MODULE ache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/owner/repo/actions/workflows
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo 64/bin/go GOINSECURE GOMOD GOMODCACHE go env e=false GO111MODULE 64/bin/go GOINSECURE %H %ct %D 0055f9aa8f99a224-ldflags go (http block)
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json 0055f9aa8f99a224GOMOD 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo 64/bin/go **/*.ts **/*.json --ignore-path /bin/sh -c echo "��� JavaScGOSUMDB git 64/bin/go tierignore dwFO3cBOLj36ZOwl-c /usr/bin/git go (http block)
  • https://api.github.com/repos/owner/repo/contents/file.md
    • Triggering command: /tmp/go-build3765746436/b383/cli.test /tmp/go-build3765746436/b383/cli.test -test.testlogfile=/tmp/go-build3765746436/b383/testlog.txt -test.paniconexit0 -test.v=true -test.parallel=4 -test.timeout=10m0s -test.run=^Test -test.short=true GOINSECURE GOMOD GOMODCACHE go env ck 'scripts/**/*GOINSECURE GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /tmp/go-build2260077797/b383/cli.test /tmp/go-build2260077797/b383/cli.test -test.testlogfile=/tmp/go-build2260077797/b383/testlog.txt -test.paniconexit0 -test.v=true -test.parallel=4 -test.timeout=10m0s -test.run=^Test -test.short=true --show-toplevel .test run-script/lib/n-json sh -c "prettier" --wriGOINSECURE git 64/bin/go "; \ else \ echo "��� Warning: .github/aw/actions-lock.json does not exist yet"; \ fi go /usr/bin/git sh (http block)
    • Triggering command: /tmp/go-build2476175366/b001/cli.test /tmp/go-build2476175366/b001/cli.test -test.testlogfile=/tmp/go-build2476175366/b001/testlog.txt -test.paniconexit0 -test.timeout=10m0s -test.run=^Test -test.short=true go 64/bin/go -json GO111MODULE run-script/lib/nnpx prettier --check '**/*.cjs' '**/*.ts' '**/*.json' --ignore-path ../../../.pr**/*.json node /hom�� --write scripts/**/*.js 64/bin/go .prettierignore --log-level=erro-c ache/go/1.25.0/x"prettier" --check 'scripts/**/*.js' --ignore-path .prettierignore bash (http block)
  • https://api.github.com/repos/test-owner/test-repo/actions/secrets
    • Triggering command: /usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name GOSUMDB GOWORK 64/bin/go GOINSECURE GOMOD GOMODCACHE go m/_n�� -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name npx prettier --wGOINSECURE git 64/bin/go --show-toplevel go /usr/bin/git node /hom�� --write scripts/**/*.js /sh .prettierignore --log-level=erro-c /usr/bin/git /bin/sh (http block)
    • Triggering command: /usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name "prettier" --wriGOINSECURE go 64/bin/go -json GO111MODULE 64/bin/go sh -c npx prettier --w**/*.ts go 64/bin/go 4015238991/.githnode GO111MODULE de_modules/.bin/--check go (http block)

If you need me to access, download, or install something from one of these locations, you can either:


💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

…e check

Move permission computation code from safe_outputs_jobs.go to the
new dedicated pkg/workflow/safe_outputs_permissions.go file.

The conformance checker (scripts/check-safe-outputs-conformance.sh)
requires this file to exist and contain ComputePermissionsForSafeOutputs.
Also removes unused 'slices' import from safe_outputs_jobs.go.

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Copilot AI changed the title [WIP] Add missing safe outputs permission computation file fix: move permission computation to dedicated safe_outputs_permissions.go Mar 9, 2026
@pelikhan pelikhan marked this pull request as ready for review March 9, 2026 22:56
Copilot AI review requested due to automatic review settings March 9, 2026 22:56
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Moves safe-outputs permission computation into the dedicated safe_outputs_permissions.go file to satisfy conformance requirement IMP-002 and keep permissions logic centralized.

Changes:

  • Added pkg/workflow/safe_outputs_permissions.go containing ComputePermissionsForSafeOutputs, SafeOutputsConfigFromKeys, and OIDC id-token auto-detection helpers.
  • Removed the moved permission-related code (and now-unused slices import) from pkg/workflow/safe_outputs_jobs.go.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File Description
pkg/workflow/safe_outputs_permissions.go New canonical home for safe-outputs permission computation and id-token detection helpers.
pkg/workflow/safe_outputs_jobs.go Removes duplicated permission logic after extraction; cleans up imports.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

case "create-project-status-update":
config.CreateProjectStatusUpdates = &CreateProjectStatusUpdateConfig{}
case "mark-pull-request-as-ready-for-review":
config.MarkPullRequestAsReadyForReview = &MarkPullRequestAsReadyForReviewConfig{}
Copy link

Copilot AI Mar 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

SafeOutputsConfigFromKeys is missing a case for the user-facing safe output key set-issue-type. This key exists in js/safe_outputs_tools.json (tool name set_issue_type → key set-issue-type), and ComputePermissionsForSafeOutputs adds issues:write permissions when SafeOutputsConfig.SetIssueType is non-nil. As a result, the interactive wizard’s permission computation path (workflow.SafeOutputsConfigFromKeys(b.SafeOutputs)) will under-compute required permissions for this selection. Add a case "set-issue-type": config.SetIssueType = &SetIssueTypeConfig{} mapping (and any other missing user-facing keys) so permission computation matches actual safe-output behavior.

Suggested change
config.MarkPullRequestAsReadyForReview = &MarkPullRequestAsReadyForReviewConfig{}
config.MarkPullRequestAsReadyForReview = &MarkPullRequestAsReadyForReviewConfig{}
case "set-issue-type":
config.SetIssueType = &SetIssueTypeConfig{}

Copilot uses AI. Check for mistakes.
@pelikhan pelikhan merged commit 82d3841 into main Mar 10, 2026
113 checks passed
@pelikhan pelikhan deleted the copilot/add-safe-outputs-permission-file branch March 10, 2026 01:18
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Safe Outputs Conformance] IMP-002: Permission computation file missing (safe_outputs_permissions.go)

3 participants