From e993b5ac135df5b4056dd8fbc7c9e4efbdf74f00 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Fri, 11 Sep 2026 23:35:12 +0000 Subject: [PATCH 1/2] Initial plan From 10166ae44550434bbcabd7a29c651897f3a3c8b4 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Fri, 11 Sep 2026 23:46:08 +0000 Subject: [PATCH 2/2] Grant centralized slash commands PR read permission Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> --- .github/workflows/ace-editor.lock.yml | 1 + .github/workflows/archie.lock.yml | 1 + .github/workflows/craft.lock.yml | 1 + .github/workflows/dependabot-burner.lock.yml | 1 + .../workflows/design-decision-gate.lock.yml | 1 + .github/workflows/grumpy-reviewer.lock.yml | 1 + .../mattpocock-skills-reviewer.lock.yml | 1 + .github/workflows/mergefest.lock.yml | 1 + .github/workflows/pdf-summary.lock.yml | 1 + .github/workflows/plan.lock.yml | 1 + .github/workflows/poem-bot.lock.yml | 1 + .github/workflows/ponytail-reviewer.lock.yml | 1 + .../pr-code-quality-reviewer.lock.yml | 1 + .../workflows/pr-nitpick-reviewer.lock.yml | 1 + .github/workflows/pr-sous-chef.lock.yml | 1 + .github/workflows/ruflo-backed-task.lock.yml | 1 + .github/workflows/scout.lock.yml | 1 + .github/workflows/security-review.lock.yml | 1 + .../workflows/smoke-agent-all-merged.lock.yml | 1 + .../workflows/smoke-agent-all-none.lock.yml | 1 + .../smoke-agent-public-approved.lock.yml | 1 + .../smoke-agent-public-none.lock.yml | 1 + .../smoke-agent-scoped-approved.lock.yml | 1 + .github/workflows/smoke-aider.lock.yml | 1 + .../workflows/smoke-call-workflow.lock.yml | 1 + .../smoke-checkout-pr-dispatch.lock.yml | 1 + .../smoke-claude-on-copilot.lock.yml | 1 + .github/workflows/smoke-claude.lock.yml | 1 + .github/workflows/smoke-codex.lock.yml | 1 + .../smoke-copilot-aoai-apikey.lock.yml | 1 + .../smoke-copilot-aoai-entra.lock.yml | 1 + .github/workflows/smoke-copilot-arm.lock.yml | 1 + .github/workflows/smoke-copilot-mai.lock.yml | 1 + .github/workflows/smoke-copilot-sdk.lock.yml | 1 + .../workflows/smoke-copilot-small.lock.yml | 1 + .github/workflows/smoke-copilot.lock.yml | 1 + .../smoke-create-cross-repo-pr.lock.yml | 1 + .github/workflows/smoke-crush.lock.yml | 1 + .github/workflows/smoke-cursor.lock.yml | 1 + .../workflows/smoke-deepseek-harness.lock.yml | 1 + .github/workflows/smoke-drive.lock.yml | 1 + .github/workflows/smoke-gemini.lock.yml | 1 + .../workflows/smoke-github-claude.lock.yml | 1 + .github/workflows/smoke-goose.lock.yml | 1 + .github/workflows/smoke-kiro.lock.yml | 1 + .github/workflows/smoke-multi-pr.lock.yml | 1 + .github/workflows/smoke-opencode.lock.yml | 1 + .../workflows/smoke-otel-backends.lock.yml | 1 + .github/workflows/smoke-pi.lock.yml | 1 + .github/workflows/smoke-project.lock.yml | 1 + .github/workflows/smoke-pydantic.lock.yml | 1 + .../workflows/smoke-service-ports.lock.yml | 1 + .github/workflows/smoke-temporary-id.lock.yml | 1 + .github/workflows/smoke-test-tools.lock.yml | 1 + .../smoke-update-cross-repo-pr.lock.yml | 1 + .github/workflows/squad-plan.lock.yml | 1 + .../workflows/test-quality-sentinel.lock.yml | 1 + .github/workflows/tidy.lock.yml | 1 + .github/workflows/unbloat-docs.lock.yml | 1 + .github/workflows/windows.lock.yml | 1 + pkg/workflow/compiler_pre_activation_job.go | 8 +++--- .../compiler_pre_activation_job_test.go | 25 +++++++++++++++++++ 62 files changed, 89 insertions(+), 4 deletions(-) diff --git a/.github/workflows/ace-editor.lock.yml b/.github/workflows/ace-editor.lock.yml index 1ea6f42edbf..75ab9578064 100644 --- a/.github/workflows/ace-editor.lock.yml +++ b/.github/workflows/ace-editor.lock.yml @@ -1721,6 +1721,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + pull-requests: read env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} outputs: diff --git a/.github/workflows/archie.lock.yml b/.github/workflows/archie.lock.yml index f0fc70ef094..db57be8d97a 100644 --- a/.github/workflows/archie.lock.yml +++ b/.github/workflows/archie.lock.yml @@ -2112,6 +2112,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + pull-requests: read env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} outputs: diff --git a/.github/workflows/craft.lock.yml b/.github/workflows/craft.lock.yml index 7e9da483d67..08cdaafb99e 100644 --- a/.github/workflows/craft.lock.yml +++ b/.github/workflows/craft.lock.yml @@ -2069,6 +2069,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + pull-requests: read env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} outputs: diff --git a/.github/workflows/dependabot-burner.lock.yml b/.github/workflows/dependabot-burner.lock.yml index a40aaa6f429..0cf5bb34200 100644 --- a/.github/workflows/dependabot-burner.lock.yml +++ b/.github/workflows/dependabot-burner.lock.yml @@ -2190,6 +2190,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + pull-requests: read env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} outputs: diff --git a/.github/workflows/design-decision-gate.lock.yml b/.github/workflows/design-decision-gate.lock.yml index d794b21ed7c..34093c2c839 100644 --- a/.github/workflows/design-decision-gate.lock.yml +++ b/.github/workflows/design-decision-gate.lock.yml @@ -2020,6 +2020,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + pull-requests: read env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} outputs: diff --git a/.github/workflows/grumpy-reviewer.lock.yml b/.github/workflows/grumpy-reviewer.lock.yml index 383743c0980..65d65dd096c 100644 --- a/.github/workflows/grumpy-reviewer.lock.yml +++ b/.github/workflows/grumpy-reviewer.lock.yml @@ -1869,6 +1869,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + pull-requests: read env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} outputs: diff --git a/.github/workflows/mattpocock-skills-reviewer.lock.yml b/.github/workflows/mattpocock-skills-reviewer.lock.yml index 7cacb9d55c6..26b1e9b756e 100644 --- a/.github/workflows/mattpocock-skills-reviewer.lock.yml +++ b/.github/workflows/mattpocock-skills-reviewer.lock.yml @@ -2008,6 +2008,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + pull-requests: read env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} outputs: diff --git a/.github/workflows/mergefest.lock.yml b/.github/workflows/mergefest.lock.yml index ce05ca15ea5..9c0abc898a0 100644 --- a/.github/workflows/mergefest.lock.yml +++ b/.github/workflows/mergefest.lock.yml @@ -1773,6 +1773,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + pull-requests: read env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} outputs: diff --git a/.github/workflows/pdf-summary.lock.yml b/.github/workflows/pdf-summary.lock.yml index 31e9ee7f3d8..1a84e027355 100644 --- a/.github/workflows/pdf-summary.lock.yml +++ b/.github/workflows/pdf-summary.lock.yml @@ -1892,6 +1892,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + pull-requests: read env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} outputs: diff --git a/.github/workflows/plan.lock.yml b/.github/workflows/plan.lock.yml index 03518e46b73..c6daa8b17bf 100644 --- a/.github/workflows/plan.lock.yml +++ b/.github/workflows/plan.lock.yml @@ -2153,6 +2153,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + pull-requests: read env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} outputs: diff --git a/.github/workflows/poem-bot.lock.yml b/.github/workflows/poem-bot.lock.yml index 41e7699d241..fab523dd576 100644 --- a/.github/workflows/poem-bot.lock.yml +++ b/.github/workflows/poem-bot.lock.yml @@ -2536,6 +2536,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + pull-requests: read env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} outputs: diff --git a/.github/workflows/ponytail-reviewer.lock.yml b/.github/workflows/ponytail-reviewer.lock.yml index d1f7faa8ad8..86d19c4b5cf 100644 --- a/.github/workflows/ponytail-reviewer.lock.yml +++ b/.github/workflows/ponytail-reviewer.lock.yml @@ -1934,6 +1934,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + pull-requests: read env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} outputs: diff --git a/.github/workflows/pr-code-quality-reviewer.lock.yml b/.github/workflows/pr-code-quality-reviewer.lock.yml index af275cb958e..a01aba1e1e8 100644 --- a/.github/workflows/pr-code-quality-reviewer.lock.yml +++ b/.github/workflows/pr-code-quality-reviewer.lock.yml @@ -2214,6 +2214,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + pull-requests: read env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} outputs: diff --git a/.github/workflows/pr-nitpick-reviewer.lock.yml b/.github/workflows/pr-nitpick-reviewer.lock.yml index ad83a7205b0..2c0e58040b7 100644 --- a/.github/workflows/pr-nitpick-reviewer.lock.yml +++ b/.github/workflows/pr-nitpick-reviewer.lock.yml @@ -1875,6 +1875,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + pull-requests: read env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} outputs: diff --git a/.github/workflows/pr-sous-chef.lock.yml b/.github/workflows/pr-sous-chef.lock.yml index 0c22e2d6ffd..b8eb6cbe85b 100644 --- a/.github/workflows/pr-sous-chef.lock.yml +++ b/.github/workflows/pr-sous-chef.lock.yml @@ -2535,6 +2535,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + pull-requests: read env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} outputs: diff --git a/.github/workflows/ruflo-backed-task.lock.yml b/.github/workflows/ruflo-backed-task.lock.yml index ab3211f61b4..bf39e5f3862 100644 --- a/.github/workflows/ruflo-backed-task.lock.yml +++ b/.github/workflows/ruflo-backed-task.lock.yml @@ -1963,6 +1963,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + pull-requests: read env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} outputs: diff --git a/.github/workflows/scout.lock.yml b/.github/workflows/scout.lock.yml index 225af3ac9f3..59149274555 100644 --- a/.github/workflows/scout.lock.yml +++ b/.github/workflows/scout.lock.yml @@ -1967,6 +1967,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + pull-requests: read env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} outputs: diff --git a/.github/workflows/security-review.lock.yml b/.github/workflows/security-review.lock.yml index f90b55bb15d..b40f9a72cd0 100644 --- a/.github/workflows/security-review.lock.yml +++ b/.github/workflows/security-review.lock.yml @@ -2490,6 +2490,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + pull-requests: read env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} outputs: diff --git a/.github/workflows/smoke-agent-all-merged.lock.yml b/.github/workflows/smoke-agent-all-merged.lock.yml index a80fa67e48d..9947777e4dd 100644 --- a/.github/workflows/smoke-agent-all-merged.lock.yml +++ b/.github/workflows/smoke-agent-all-merged.lock.yml @@ -1852,6 +1852,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + pull-requests: read env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} outputs: diff --git a/.github/workflows/smoke-agent-all-none.lock.yml b/.github/workflows/smoke-agent-all-none.lock.yml index 6dac3051842..ab25cdcbc6f 100644 --- a/.github/workflows/smoke-agent-all-none.lock.yml +++ b/.github/workflows/smoke-agent-all-none.lock.yml @@ -1847,6 +1847,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + pull-requests: read env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} outputs: diff --git a/.github/workflows/smoke-agent-public-approved.lock.yml b/.github/workflows/smoke-agent-public-approved.lock.yml index 2a416f164fe..0e9d7f125b5 100644 --- a/.github/workflows/smoke-agent-public-approved.lock.yml +++ b/.github/workflows/smoke-agent-public-approved.lock.yml @@ -1904,6 +1904,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + pull-requests: read env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} outputs: diff --git a/.github/workflows/smoke-agent-public-none.lock.yml b/.github/workflows/smoke-agent-public-none.lock.yml index f178dbb2167..b0f985faffd 100644 --- a/.github/workflows/smoke-agent-public-none.lock.yml +++ b/.github/workflows/smoke-agent-public-none.lock.yml @@ -1847,6 +1847,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + pull-requests: read env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} outputs: diff --git a/.github/workflows/smoke-agent-scoped-approved.lock.yml b/.github/workflows/smoke-agent-scoped-approved.lock.yml index 5b2b0eefd61..729a8a20484 100644 --- a/.github/workflows/smoke-agent-scoped-approved.lock.yml +++ b/.github/workflows/smoke-agent-scoped-approved.lock.yml @@ -1912,6 +1912,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + pull-requests: read env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} outputs: diff --git a/.github/workflows/smoke-aider.lock.yml b/.github/workflows/smoke-aider.lock.yml index d5e6e8510fb..b2a29f23576 100644 --- a/.github/workflows/smoke-aider.lock.yml +++ b/.github/workflows/smoke-aider.lock.yml @@ -1812,6 +1812,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + pull-requests: read env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} outputs: diff --git a/.github/workflows/smoke-call-workflow.lock.yml b/.github/workflows/smoke-call-workflow.lock.yml index c0a91aa599a..5fbbc934a91 100644 --- a/.github/workflows/smoke-call-workflow.lock.yml +++ b/.github/workflows/smoke-call-workflow.lock.yml @@ -1921,6 +1921,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + pull-requests: read env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} outputs: diff --git a/.github/workflows/smoke-checkout-pr-dispatch.lock.yml b/.github/workflows/smoke-checkout-pr-dispatch.lock.yml index 90297fb7127..0d796fd59ed 100644 --- a/.github/workflows/smoke-checkout-pr-dispatch.lock.yml +++ b/.github/workflows/smoke-checkout-pr-dispatch.lock.yml @@ -1821,6 +1821,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + pull-requests: read env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} outputs: diff --git a/.github/workflows/smoke-claude-on-copilot.lock.yml b/.github/workflows/smoke-claude-on-copilot.lock.yml index f8425cd24d3..42f660aeafb 100644 --- a/.github/workflows/smoke-claude-on-copilot.lock.yml +++ b/.github/workflows/smoke-claude-on-copilot.lock.yml @@ -1765,6 +1765,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + pull-requests: read env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} outputs: diff --git a/.github/workflows/smoke-claude.lock.yml b/.github/workflows/smoke-claude.lock.yml index a458ad5223b..baaddb4f6e1 100644 --- a/.github/workflows/smoke-claude.lock.yml +++ b/.github/workflows/smoke-claude.lock.yml @@ -2633,6 +2633,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + pull-requests: read env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} outputs: diff --git a/.github/workflows/smoke-codex.lock.yml b/.github/workflows/smoke-codex.lock.yml index 2c897cffb57..0008d41bd34 100644 --- a/.github/workflows/smoke-codex.lock.yml +++ b/.github/workflows/smoke-codex.lock.yml @@ -2386,6 +2386,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + pull-requests: read env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} outputs: diff --git a/.github/workflows/smoke-copilot-aoai-apikey.lock.yml b/.github/workflows/smoke-copilot-aoai-apikey.lock.yml index 2b43a4c8adb..35351e6e40e 100644 --- a/.github/workflows/smoke-copilot-aoai-apikey.lock.yml +++ b/.github/workflows/smoke-copilot-aoai-apikey.lock.yml @@ -3495,6 +3495,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + pull-requests: read env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} outputs: diff --git a/.github/workflows/smoke-copilot-aoai-entra.lock.yml b/.github/workflows/smoke-copilot-aoai-entra.lock.yml index f4424e010b1..f4f60bcbc64 100644 --- a/.github/workflows/smoke-copilot-aoai-entra.lock.yml +++ b/.github/workflows/smoke-copilot-aoai-entra.lock.yml @@ -3525,6 +3525,7 @@ jobs: environment: aoai-model permissions: contents: read + pull-requests: read env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} outputs: diff --git a/.github/workflows/smoke-copilot-arm.lock.yml b/.github/workflows/smoke-copilot-arm.lock.yml index 3286c8e8750..4e8621a1777 100644 --- a/.github/workflows/smoke-copilot-arm.lock.yml +++ b/.github/workflows/smoke-copilot-arm.lock.yml @@ -2957,6 +2957,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + pull-requests: read env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} outputs: diff --git a/.github/workflows/smoke-copilot-mai.lock.yml b/.github/workflows/smoke-copilot-mai.lock.yml index da964f52057..c5d0b956f3e 100644 --- a/.github/workflows/smoke-copilot-mai.lock.yml +++ b/.github/workflows/smoke-copilot-mai.lock.yml @@ -1844,6 +1844,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + pull-requests: read env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} outputs: diff --git a/.github/workflows/smoke-copilot-sdk.lock.yml b/.github/workflows/smoke-copilot-sdk.lock.yml index f0d85330c8a..985030b428d 100644 --- a/.github/workflows/smoke-copilot-sdk.lock.yml +++ b/.github/workflows/smoke-copilot-sdk.lock.yml @@ -1813,6 +1813,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + pull-requests: read env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} outputs: diff --git a/.github/workflows/smoke-copilot-small.lock.yml b/.github/workflows/smoke-copilot-small.lock.yml index 8e6836db20e..fe253eda4a2 100644 --- a/.github/workflows/smoke-copilot-small.lock.yml +++ b/.github/workflows/smoke-copilot-small.lock.yml @@ -1839,6 +1839,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + pull-requests: read env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} outputs: diff --git a/.github/workflows/smoke-copilot.lock.yml b/.github/workflows/smoke-copilot.lock.yml index d389a31d4fd..6189aef754f 100644 --- a/.github/workflows/smoke-copilot.lock.yml +++ b/.github/workflows/smoke-copilot.lock.yml @@ -3528,6 +3528,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + pull-requests: read env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} outputs: diff --git a/.github/workflows/smoke-create-cross-repo-pr.lock.yml b/.github/workflows/smoke-create-cross-repo-pr.lock.yml index ece620e7ba8..2a20d8a2e4c 100644 --- a/.github/workflows/smoke-create-cross-repo-pr.lock.yml +++ b/.github/workflows/smoke-create-cross-repo-pr.lock.yml @@ -1920,6 +1920,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + pull-requests: read env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} outputs: diff --git a/.github/workflows/smoke-crush.lock.yml b/.github/workflows/smoke-crush.lock.yml index 2ed9061f1f8..c11f79c7841 100644 --- a/.github/workflows/smoke-crush.lock.yml +++ b/.github/workflows/smoke-crush.lock.yml @@ -2155,6 +2155,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + pull-requests: read env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} outputs: diff --git a/.github/workflows/smoke-cursor.lock.yml b/.github/workflows/smoke-cursor.lock.yml index ec318ea1fe8..b858c0b8041 100644 --- a/.github/workflows/smoke-cursor.lock.yml +++ b/.github/workflows/smoke-cursor.lock.yml @@ -2034,6 +2034,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + pull-requests: read env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} outputs: diff --git a/.github/workflows/smoke-deepseek-harness.lock.yml b/.github/workflows/smoke-deepseek-harness.lock.yml index be97b30cc23..634ea1e5c83 100644 --- a/.github/workflows/smoke-deepseek-harness.lock.yml +++ b/.github/workflows/smoke-deepseek-harness.lock.yml @@ -1945,6 +1945,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + pull-requests: read env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} outputs: diff --git a/.github/workflows/smoke-drive.lock.yml b/.github/workflows/smoke-drive.lock.yml index 5c026d3cbc3..356758165d1 100644 --- a/.github/workflows/smoke-drive.lock.yml +++ b/.github/workflows/smoke-drive.lock.yml @@ -2023,6 +2023,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + pull-requests: read env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} outputs: diff --git a/.github/workflows/smoke-gemini.lock.yml b/.github/workflows/smoke-gemini.lock.yml index 9445ab2bd04..5ccec9a8a09 100644 --- a/.github/workflows/smoke-gemini.lock.yml +++ b/.github/workflows/smoke-gemini.lock.yml @@ -2245,6 +2245,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + pull-requests: read env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} outputs: diff --git a/.github/workflows/smoke-github-claude.lock.yml b/.github/workflows/smoke-github-claude.lock.yml index 7405277e035..61c23230584 100644 --- a/.github/workflows/smoke-github-claude.lock.yml +++ b/.github/workflows/smoke-github-claude.lock.yml @@ -1765,6 +1765,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + pull-requests: read env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} outputs: diff --git a/.github/workflows/smoke-goose.lock.yml b/.github/workflows/smoke-goose.lock.yml index 47d8ecc65f7..ecffb084b1d 100644 --- a/.github/workflows/smoke-goose.lock.yml +++ b/.github/workflows/smoke-goose.lock.yml @@ -2127,6 +2127,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + pull-requests: read env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} outputs: diff --git a/.github/workflows/smoke-kiro.lock.yml b/.github/workflows/smoke-kiro.lock.yml index a22d2016347..113534507bd 100644 --- a/.github/workflows/smoke-kiro.lock.yml +++ b/.github/workflows/smoke-kiro.lock.yml @@ -1943,6 +1943,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + pull-requests: read env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} outputs: diff --git a/.github/workflows/smoke-multi-pr.lock.yml b/.github/workflows/smoke-multi-pr.lock.yml index 130e514dd79..11be26e7d4b 100644 --- a/.github/workflows/smoke-multi-pr.lock.yml +++ b/.github/workflows/smoke-multi-pr.lock.yml @@ -1883,6 +1883,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + pull-requests: read env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} outputs: diff --git a/.github/workflows/smoke-opencode.lock.yml b/.github/workflows/smoke-opencode.lock.yml index 1f304e06b6a..1da9bdedc8c 100644 --- a/.github/workflows/smoke-opencode.lock.yml +++ b/.github/workflows/smoke-opencode.lock.yml @@ -1980,6 +1980,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + pull-requests: read env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} outputs: diff --git a/.github/workflows/smoke-otel-backends.lock.yml b/.github/workflows/smoke-otel-backends.lock.yml index 6eda8dc492d..96560b84374 100644 --- a/.github/workflows/smoke-otel-backends.lock.yml +++ b/.github/workflows/smoke-otel-backends.lock.yml @@ -2072,6 +2072,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + pull-requests: read env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} outputs: diff --git a/.github/workflows/smoke-pi.lock.yml b/.github/workflows/smoke-pi.lock.yml index dab753b9c6d..6d615ac4ba3 100644 --- a/.github/workflows/smoke-pi.lock.yml +++ b/.github/workflows/smoke-pi.lock.yml @@ -1850,6 +1850,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + pull-requests: read env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} outputs: diff --git a/.github/workflows/smoke-project.lock.yml b/.github/workflows/smoke-project.lock.yml index 5ab217e7a21..7aab1d2b711 100644 --- a/.github/workflows/smoke-project.lock.yml +++ b/.github/workflows/smoke-project.lock.yml @@ -2492,6 +2492,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + pull-requests: read env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} outputs: diff --git a/.github/workflows/smoke-pydantic.lock.yml b/.github/workflows/smoke-pydantic.lock.yml index 053fd114495..4facb47c91d 100644 --- a/.github/workflows/smoke-pydantic.lock.yml +++ b/.github/workflows/smoke-pydantic.lock.yml @@ -2209,6 +2209,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + pull-requests: read env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} outputs: diff --git a/.github/workflows/smoke-service-ports.lock.yml b/.github/workflows/smoke-service-ports.lock.yml index 59b92b41acc..28a7cc4b49e 100644 --- a/.github/workflows/smoke-service-ports.lock.yml +++ b/.github/workflows/smoke-service-ports.lock.yml @@ -1779,6 +1779,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + pull-requests: read env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} outputs: diff --git a/.github/workflows/smoke-temporary-id.lock.yml b/.github/workflows/smoke-temporary-id.lock.yml index 70793db6748..02530f3253c 100644 --- a/.github/workflows/smoke-temporary-id.lock.yml +++ b/.github/workflows/smoke-temporary-id.lock.yml @@ -2152,6 +2152,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + pull-requests: read env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} outputs: diff --git a/.github/workflows/smoke-test-tools.lock.yml b/.github/workflows/smoke-test-tools.lock.yml index ee6288361d7..50f876aa97c 100644 --- a/.github/workflows/smoke-test-tools.lock.yml +++ b/.github/workflows/smoke-test-tools.lock.yml @@ -1846,6 +1846,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + pull-requests: read env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} outputs: diff --git a/.github/workflows/smoke-update-cross-repo-pr.lock.yml b/.github/workflows/smoke-update-cross-repo-pr.lock.yml index a772b1bc0ac..9c4a969e6e6 100644 --- a/.github/workflows/smoke-update-cross-repo-pr.lock.yml +++ b/.github/workflows/smoke-update-cross-repo-pr.lock.yml @@ -1939,6 +1939,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + pull-requests: read env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} outputs: diff --git a/.github/workflows/squad-plan.lock.yml b/.github/workflows/squad-plan.lock.yml index 59bcd7ecdc0..f112953dd6d 100644 --- a/.github/workflows/squad-plan.lock.yml +++ b/.github/workflows/squad-plan.lock.yml @@ -1792,6 +1792,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + pull-requests: read env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} outputs: diff --git a/.github/workflows/test-quality-sentinel.lock.yml b/.github/workflows/test-quality-sentinel.lock.yml index 68cee19196e..a4cd4a92848 100644 --- a/.github/workflows/test-quality-sentinel.lock.yml +++ b/.github/workflows/test-quality-sentinel.lock.yml @@ -2157,6 +2157,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + pull-requests: read env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} outputs: diff --git a/.github/workflows/tidy.lock.yml b/.github/workflows/tidy.lock.yml index d39b190811e..b6b3c575e32 100644 --- a/.github/workflows/tidy.lock.yml +++ b/.github/workflows/tidy.lock.yml @@ -2150,6 +2150,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + pull-requests: read env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} outputs: diff --git a/.github/workflows/unbloat-docs.lock.yml b/.github/workflows/unbloat-docs.lock.yml index 9fddf02809a..ac179acd67c 100644 --- a/.github/workflows/unbloat-docs.lock.yml +++ b/.github/workflows/unbloat-docs.lock.yml @@ -2112,6 +2112,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + pull-requests: read env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} outputs: diff --git a/.github/workflows/windows.lock.yml b/.github/workflows/windows.lock.yml index f3449fb32bb..e8b40433d5f 100644 --- a/.github/workflows/windows.lock.yml +++ b/.github/workflows/windows.lock.yml @@ -1845,6 +1845,7 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + pull-requests: read env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} outputs: diff --git a/pkg/workflow/compiler_pre_activation_job.go b/pkg/workflow/compiler_pre_activation_job.go index 13f07205539..a286203f54c 100644 --- a/pkg/workflow/compiler_pre_activation_job.go +++ b/pkg/workflow/compiler_pre_activation_job.go @@ -103,10 +103,10 @@ func (c *Compiler) buildPreActivationPermissions(data *WorkflowData, setupAction } perms.Set(PermissionActions, PermissionRead) } - // Auto-grant pull-requests: read when label_command uses decentralized strategy - // with pull_request events. The check_membership.cjs script calls the pulls API - // to verify PR provenance, which requires pull-requests: read. - if data.LabelCommandDecentralized && slices.Contains(FilterLabelCommandEvents(data.LabelCommandEvents), "pull_request") { + // Auto-grant pull-requests: read when check_membership.cjs may call the pulls API + // to verify PR provenance. + if (data.CommandCentralized && len(data.Command) > 0) || + (data.LabelCommandDecentralized && slices.Contains(FilterLabelCommandEvents(data.LabelCommandEvents), "pull_request")) { if perms == nil { perms = NewPermissions() } diff --git a/pkg/workflow/compiler_pre_activation_job_test.go b/pkg/workflow/compiler_pre_activation_job_test.go index f8dc4d2a6d9..1b71e6d3f54 100644 --- a/pkg/workflow/compiler_pre_activation_job_test.go +++ b/pkg/workflow/compiler_pre_activation_job_test.go @@ -24,6 +24,31 @@ func TestBuildPreActivationPermissions(t *testing.T) { assert.Empty(t, permissions) }) + t.Run("centralized command grants pull request read", func(t *testing.T) { + c := NewCompiler() + c.SetActionMode(ActionModeRelease) + + _, permissions := c.buildPreActivationPermissions(&WorkflowData{ + Name: "wf", + Command: []string{"triage"}, + CommandCentralized: true, + }, "./actions/setup") + + assert.Contains(t, permissions, "pull-requests: read") + }) + + t.Run("non-centralized command keeps permissions empty", func(t *testing.T) { + c := NewCompiler() + c.SetActionMode(ActionModeRelease) + + _, permissions := c.buildPreActivationPermissions(&WorkflowData{ + Name: "wf", + Command: []string{"triage"}, + }, "./actions/setup") + + assert.Empty(t, permissions) + }) + t.Run("script mode merges inferred and explicit permissions", func(t *testing.T) { c := NewCompiler() c.SetActionMode(ActionModeScript)