Grant PR read permission to centralized slash commands

[Copilot]

Centralized slash commands invoked from pull requests could silently skip execution because pre_activation lacked permission to verify PR provenance.

• Permission inference

  • Grant pull-requests: read when a workflow defines a centralized slash command.
  • Preserve existing permission behavior for non-centralized commands and decentralized label commands.

• Regression coverage

  • Verify centralized commands receive the required permission.
  • Verify non-centralized commands do not receive it.

• Generated workflows

  • Recompile affected workflow lock files with the new job-scoped permission:

pre_activation:
  permissions:
    pull-requests: read

• Fixes Centralized slash_command pre_activation missing pull-requests:read, causes silent no-op with success conclusion on PR-invoked commands #60268

[Copilot]

🟢 Approval recommended

The permission inference matches the provenance-check path, preserves existing behavior, and has focused regression coverage.

Pull request overview

Adds the missing PR metadata permission required for centralized slash-command provenance checks.

Changes:

• Infers pull-requests: read for centralized commands.
• Adds positive and negative regression tests.
• Regenerates 60 affected workflow locks.

File summaries

File	Description
pkg/workflow/compiler_pre_activation_job.go	Infers PR read permission.
pkg/workflow/compiler_pre_activation_job_test.go	Tests centralized and non-centralized behavior.
.github/workflows/windows.lock.yml	Regenerates permission.
.github/workflows/unbloat-docs.lock.yml	Regenerates permission.
.github/workflows/tidy.lock.yml	Regenerates permission.
.github/workflows/test-quality-sentinel.lock.yml	Regenerates permission.
.github/workflows/squad-plan.lock.yml	Regenerates permission.
.github/workflows/smoke-update-cross-repo-pr.lock.yml	Regenerates permission.
.github/workflows/smoke-test-tools.lock.yml	Regenerates permission.
.github/workflows/smoke-temporary-id.lock.yml	Regenerates permission.
.github/workflows/smoke-service-ports.lock.yml	Regenerates permission.
.github/workflows/smoke-pydantic.lock.yml	Regenerates permission.
.github/workflows/smoke-project.lock.yml	Regenerates permission.
.github/workflows/smoke-pi.lock.yml	Regenerates permission.
.github/workflows/smoke-otel-backends.lock.yml	Regenerates permission.
.github/workflows/smoke-opencode.lock.yml	Regenerates permission.
.github/workflows/smoke-multi-pr.lock.yml	Regenerates permission.
.github/workflows/smoke-kiro.lock.yml	Regenerates permission.
.github/workflows/smoke-goose.lock.yml	Regenerates permission.
.github/workflows/smoke-github-claude.lock.yml	Regenerates permission.
.github/workflows/smoke-gemini.lock.yml	Regenerates permission.
.github/workflows/smoke-drive.lock.yml	Regenerates permission.
.github/workflows/smoke-deepseek-harness.lock.yml	Regenerates permission.
.github/workflows/smoke-cursor.lock.yml	Regenerates permission.
.github/workflows/smoke-crush.lock.yml	Regenerates permission.
.github/workflows/smoke-create-cross-repo-pr.lock.yml	Regenerates permission.
.github/workflows/smoke-copilot.lock.yml	Regenerates permission.
.github/workflows/smoke-copilot-small.lock.yml	Regenerates permission.
.github/workflows/smoke-copilot-sdk.lock.yml	Regenerates permission.
.github/workflows/smoke-copilot-mai.lock.yml	Regenerates permission.
.github/workflows/smoke-copilot-arm.lock.yml	Regenerates permission.
.github/workflows/smoke-copilot-aoai-entra.lock.yml	Regenerates permission.
.github/workflows/smoke-copilot-aoai-apikey.lock.yml	Regenerates permission.
.github/workflows/smoke-codex.lock.yml	Regenerates permission.
.github/workflows/smoke-claude.lock.yml	Regenerates permission.
.github/workflows/smoke-claude-on-copilot.lock.yml	Regenerates permission.
.github/workflows/smoke-checkout-pr-dispatch.lock.yml	Regenerates permission.
.github/workflows/smoke-call-workflow.lock.yml	Regenerates permission.
.github/workflows/smoke-aider.lock.yml	Regenerates permission.
.github/workflows/smoke-agent-scoped-approved.lock.yml	Regenerates permission.
.github/workflows/smoke-agent-public-none.lock.yml	Regenerates permission.
.github/workflows/smoke-agent-public-approved.lock.yml	Regenerates permission.
.github/workflows/smoke-agent-all-none.lock.yml	Regenerates permission.
.github/workflows/smoke-agent-all-merged.lock.yml	Regenerates permission.
.github/workflows/security-review.lock.yml	Regenerates permission.
.github/workflows/scout.lock.yml	Regenerates permission.
.github/workflows/ruflo-backed-task.lock.yml	Regenerates permission.
.github/workflows/pr-sous-chef.lock.yml	Regenerates permission.
.github/workflows/pr-nitpick-reviewer.lock.yml	Regenerates permission.
.github/workflows/pr-code-quality-reviewer.lock.yml	Regenerates permission.
.github/workflows/ponytail-reviewer.lock.yml	Regenerates permission.
.github/workflows/poem-bot.lock.yml	Regenerates permission.
.github/workflows/plan.lock.yml	Regenerates permission.
.github/workflows/pdf-summary.lock.yml	Regenerates permission.
.github/workflows/mergefest.lock.yml	Regenerates permission.
.github/workflows/mattpocock-skills-reviewer.lock.yml	Regenerates permission.
.github/workflows/grumpy-reviewer.lock.yml	Regenerates permission.
.github/workflows/design-decision-gate.lock.yml	Regenerates permission.
.github/workflows/dependabot-burner.lock.yml	Regenerates permission.
.github/workflows/craft.lock.yml	Regenerates permission.
.github/workflows/archie.lock.yml	Regenerates permission.
.github/workflows/ace-editor.lock.yml	Regenerates permission.

Review details

• Files reviewed: 62/62 changed files
• Comments generated: 0
• Review effort level: Balanced

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.