Skip to content

Preserve issues: write in safe-outputs App token when update-project is co-configured#30738

Merged
pelikhan merged 3 commits into
mainfrom
copilot/fix-safe-outputs-permission-issue
May 7, 2026
Merged

Preserve issues: write in safe-outputs App token when update-project is co-configured#30738
pelikhan merged 3 commits into
mainfrom
copilot/fix-safe-outputs-permission-issue

Conversation

Copy link
Copy Markdown
Contributor

Copilot AI commented May 7, 2026

safe-outputs permission aggregation regressed when update-project was present with add-comment/add-labels: the minted App token emitted permission-issues: read instead of write, causing issue mutations to fail at runtime. This change keeps cross-handler permission union semantics so project handlers no longer downgrade an already-required issues: write.

  • Permission aggregation fix

    • Updated project-handler permission logic to set issues: read only when issues: write is not already required.
    • Applied to both create-project and update-project paths in ComputePermissionsForSafeOutputs.
  • Regression coverage: permission model

    • Added a targeted test case for add-comment + add-labels + update-project to assert final computed permissions keep issues: write while still including organization-projects: write.
  • Regression coverage: compiled App token/job output

    • Added a safe-outputs App token test asserting compiled workflow includes:
      • permission-issues: write
      • permission-organization-projects: write
    • Also asserts job-level permissions keep issues: write for the same configuration.
if current, exists := permissions.Get(PermissionIssues); !exists || current != PermissionWrite {
	permissions.Set(PermissionIssues, PermissionRead)
}

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

  • https://api.github.com/graphql
    • Triggering command: /usr/bin/gh gh repo view --json owner,name --jq .owner.login + "/" + .name cfg (http block)
    • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw -j DROP ache/go/1.25.8/xTest User (http block)
    • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw (http block)
  • https://api.github.com/orgs/test-owner/actions/secrets
    • Triggering command: /usr/bin/gh gh api /orgs/test-owner/actions/secrets --jq .secrets[].name (http block)
    • Triggering command: /usr/bin/gh gh api /orgs/test-owner/actions/secrets --jq .secrets[].name h ../../../.prettierignore git (http block)
    • Triggering command: /usr/bin/gh gh api /orgs/test-owner/actions/secrets --jq .secrets[].name h ../../../.prettierignore git bject.type] | @tsv --show-toplevel git /usr/bin/git git rev-�� w/js/**/*.json' --ignore-path git bject.type] | @tsv --show-toplevel git (http block)
  • https://api.github.com/repos/actions/ai-inference/git/ref/tags/v1
    • Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq [.object.sha, .object.type] | @tsv --show-toplevel /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/vet /usr/bin/git runs/20260507-03git /tmp/go-build402rev-parse (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq [.object.sha, .object.type] | @tsv --show-toplevel 647325/b125/importcfg /usr/bin/git sistency_KeyOrdegit k/gh-aw/gh-aw/cmrev-parse /opt/hostedtoolc--show-toplevel git rev-�� --show-toplevel /opt/hostedtoolcache/go/1.25.8/x-f /usr/bin/git licyTrustedUsersgh -trimpath ache/node/24.14./repos/actions/github-script/git/ref/tags/v9 git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq [.object.sha, .object.type] | @tsv --show-toplevel node /usr/bin/git k/gh-aw/gh-aw/.ggit scripts/**/*.js /opt/hostedtoolc--show-toplevel git rev-�� --show-toplevel /opt/hostedtoolcache/go/1.25.8/x-f /usr/bin/git licyMinIntegritygh git /usr/bin/git git (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v3
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq [.object.sha, .object.type] | @tsv /ref/tags/v9 x_amd64/link sv rite '**/*.cjs' gh cfg 64/pkg/tool/linu/repos/actions/github-script/git/ref/tags/v9 git conf�� user.email test@example.com /usr/bin/git te 'scripts/**/*git cfg 64/pkg/tool/linu--show-toplevel /usr/bin/git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq [.object.sha, .object.type] | @tsv /ref/tags/v9 infocmp sv celain --ignore-gh infocmp x_amd64/vet git conf�� user.name Test User /usr/bin/infocmp '**/*.ts' '**/*.git gh ules/.bin/node infocmp (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq [.object.sha, .object.type] | @tsv /ref/tags/v9 git sv 16a31dcf:pkg/worgh git 64/bin/node git rev-�� --show-toplevel git /usr/bin/infocmp source-field-vargit git ache/go/1.25.8/x--show-toplevel infocmp (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v5
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq [.object.sha, .object.type] | @tsv runs/20260507-035138-14067/test-source-field-variant-3090447920 -buildtags 1/x64/bin/node -errorsas -ifaceassert -nilfunc 1/x64/bin/node -uns�� mplied /tmp/go-build402929814/b270/vet.cfg /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/vet h ../../../.pretinfocmp set x86_64/git /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq [.object.sha, .object.type] | @tsv ithub-script/git/ref/tags/v9 git bject.type] | @tsv --get remote.origin.urrev-parse /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git 964299338 (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq [.object.sha, .object.type] | @tsv --show-toplevel git /usr/bin/git --show-toplevel 64/pkg/tool/linurev-parse /usr/bin/git git rev-�� /ref/tags/v9 git sv --show-toplevel /opt/hostedtoolcrev-parse /usr/bin/gh gh (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v6
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv /tmp/gh-aw-test-runs/20260507-035138-14067/test-source-field-variant-3090447920/.github/workflowgit remote /usr/lib/git-core/git-receive-pack (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv /tmp/gh-aw-test-runs/20260507-035138-14067/test-3432398280/.github/workflows l /usr/bin/git remote.origin.urgit (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv /home/REDACTED/work/gh-aw/gh-aw/.github/workflows/api-consumption-report.md x_amd64/vet /usr/bin/git '**/*.ts' '**/*.git (http block)
  • https://api.github.com/repos/actions/github-script/git/ref/tags/v8
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq [.object.sha, .object.type] | @tsv --show-toplevel git /usr/bin/git user.email test@example.comapi /usr/bin/git git rev-�� ithub-script/git/ref/tags/v9 git bject.type] | @tsv /tmp/gh-aw-test-git status /usr/bin/git git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq [.object.sha, .object.type] | @tsv xterm-color git /usr/bin/git user.name Test User /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git /ref/tags/v9 git sv git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq [.object.sha, .object.type] | @tsv --show-toplevel git /usr/bin/git add origin /usr/bin/git git rev-�� ithub-script/git/ref/tags/v9 git bject.type] | @tsv .github/workflowgit resolved$ (http block)
  • https://api.github.com/repos/actions/github-script/git/ref/tags/v9
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq [.object.sha, .object.type] | @tsv (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq [.object.sha, .object.type] | @tsv -c=4 -nolocalimports -importcfg /tmp/go-build402929814/b417/importcfg -pack /home/REDACTED/work/gh-aw/gh-aw/pkg/constants/spec_test.go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq [.object.sha, .object.type] | @tsv -c=4 -nolocalimports -importcfg /tmp/go-build402929814/b438/importcfg -pack /home/REDACTED/work/gh-aw/gh-aw/pkg/parser/import_conflict_test.go /home/REDACTED/work/gh-aw/gh-aw/pkg/parser/import_cycle_test.go ode_�� (http block)
  • https://api.github.com/repos/actions/github-script/git/ref/tags/v9.0.0
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9.0.0 --jq [.object.sha, .object.type] | @tsv (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9.0.0 --jq [.object.sha, .object.type] | @tsv go1.25.8 -c=4 -nolocalimports -importcfg /tmp/go-build402929814/b400/importcfg -pack /tmp/go-build402929814/b400/_testmain.go ode_�� (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9.0.0 --jq [.object.sha, .object.type] | @tsv -c=4 -nolocalimports -importcfg /tmp/go-build402929814/b410/importcfg -pack /home/REDACTED/go/pkg/mod/github.com/aymanbagabas/go-udiff@v0.4.1/diff.go So_z10iwA5KW ode_�� (http block)
  • https://api.github.com/repos/actions/setup-go/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv /repos/actions/github-script/git/ref/tags/v9 --jq /usr/bin/git v2n3519Id -buildtags 1/x64/bin/node git rev-�� --show-toplevel 1/x64/bin/node /usr/bin/git g/testutil/spec_git g/testutil/tempdrev-parse ache/go/1.25.8/x--show-toplevel git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv /repos/actions/github-script/git/ref/tags/v9 --jq /usr/bin/git CommaSeparatedCogh -buildtags /home/REDACTED/wor/repos/actions/github-script/git/ref/tags/v9 git rev-�� --show-toplevel node /usr/bin/git prettier --write 647325/b307/vet.--show-toplevel git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv /repos/actions/github-script/git/ref/tags/v9 --jq /usr/bin/git Onlyrepos_only_wgh on rkflow/js/**/*.j/repos/actions/github-script/git/ref/tags/v9 git rev-�� --show-toplevel sh /usr/bin/git npx prettier --wgit (http block)
  • https://api.github.com/repos/actions/setup-node/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv --get remote.origin.url (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv --show-toplevel /opt/hostedtoolc-buildtags /usr/bin/infocmp 2938263831 /tmp/go-build402rev-parse e/git-upload-pac--show-toplevel infocmp -1 xterm-color /opt/hostedtoolc-tests /usr/bin/git -unreachable=falgit /tmp/go-build402rev-parse 929814/b455/styl--show-toplevel git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv --show-toplevel infocmp /usr/bin/git xterm-color (http block)
  • https://api.github.com/repos/actions/setup-node/git/ref/tags/v6
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv /repos/actions/github-script/git/ref/tags/v9.0.0 --jq ache/node/24.14.1/x64/bin/node (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv --show-toplevel (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv --show-toplevel x_amd64/vet /usr/bin/git '**/*.ts' '**/*.git (http block)
  • https://api.github.com/repos/actions/upload-artifact/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv /ref/tags/v9 x_amd64/vet sv get --local x_amd64/vet git add /ref/tags/v9 x_amd64/vet sv *.json' '!../../git --local 64/pkg/tool/linu--show-toplevel ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv xterm-color git /usr/bin/git iant-3693099457/git git ules/.bin/sh git -C ithub-script/git/ref/tags/v9.0.0 remote bject.type] | @tsv .js' --ignore-pagit infocmp k/_temp/uv-pytho--show-toplevel git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv /home/REDACTED/work/gh-aw/gh-aw/.github/workflows rev-parse /usr/bin/git lex-frontmatter-git git ndor/bin/git git -C /tmp/TestCompileErrorFormatting2010717909/001 remote /usr/bin/git Gitmaster_branchgit Gitmaster_branchrev-parse (http block)
  • https://api.github.com/repos/aws-actions/configure-aws-credentials/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/aws-actions/configure-aws-credentials/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv --show-toplevel git /usr/bin/git 964299338 rev-parse /opt/hostedtoolc--show-toplevel git rev-�� --show-toplevel /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linu-f /usr/bin/git /tmp/go-build402gh l /usr/bin/git git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/aws-actions/configure-aws-credentials/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv --show-toplevel git /usr/bin/git /tmp/TestGuardPogh remote /usr/bin/gh git rev-�� /ref/tags/v9 gh sv thImports3369323git l /opt/hostedtoolc--show-toplevel infocmp (http block)
    • Triggering command: /usr/bin/gh gh api /repos/aws-actions/configure-aws-credentials/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv ithub-script/git/ref/tags/v9 git bject.type] | @tsv /tmp/gh-aw-test-git config /usr/bin/gh git rev-�� --show-toplevel gh /usr/bin/git /repos/actions/ginfocmp --jq om/org2/repo.gitxterm-color git (http block)
  • https://api.github.com/repos/azure/login/git/ref/tags/v2
    • Triggering command: /usr/bin/gh gh api /repos/azure/login/git/ref/tags/v2 --jq [.object.sha, .object.type] | @tsv --show-toplevel git /usr/bin/git 964299338 config /opt/hostedtoolc--show-toplevel git rev-�� --show-toplevel /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/vet /usr/bin/git -unreachable=falinfocmp l /opt/hostedtoolcxterm-color git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/azure/login/git/ref/tags/v2 --jq [.object.sha, .object.type] | @tsv --show-toplevel git /usr/bin/git --show-toplevel git repository(ownexterm-color git rev-�� /ref/tags/v9 /opt/hostedtoolcache/node/24.14.1/x64/bin/node sv /ref/tags/v9 l sv gh (http block)
    • Triggering command: /usr/bin/gh gh api /repos/azure/login/git/ref/tags/v2 --jq [.object.sha, .object.type] | @tsv --show-toplevel infocmp /usr/bin/git xterm-color infocmp /usr/bin/gh git rev-�� --show-toplevel gh /usr/bin/git /repos/actions/ginfocmp --jq /usr/bin/git git (http block)
  • https://api.github.com/repos/docker/login-action/git/ref/tags/v3
    • Triggering command: /usr/bin/gh gh api /repos/docker/login-action/git/ref/tags/v3 --jq [.object.sha, .object.type] | @tsv --show-toplevel git /usr/bin/git 964299338 (http block)
    • Triggering command: /usr/bin/gh gh api /repos/docker/login-action/git/ref/tags/v3 --jq [.object.sha, .object.type] | @tsv --show-toplevel infocmp /usr/bin/git xterm-color git /usr/bin/gh git rev-�� --show-toplevel gh /usr/bin/git thImports6069052infocmp --jq /usr/bin/gh git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/docker/login-action/git/ref/tags/v3 --jq [.object.sha, .object.type] | @tsv --show-toplevel git /usr/bin/git ithub-script/gitgit remote bject.type] | @t--show-toplevel git rev-�� --show-toplevel git /usr/bin/infocmp mpleWorkflow3266infocmp remote /usr/bin/git infocmp (http block)
  • https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v0.1.2
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v0.1.2 --jq [.object.sha, .object.type] | @tsv /repos/actions/github-script/git/ref/tags/v9 --jq /usr/bin/gh -unreachable=falgit /tmp/go-build402rev-parse e/git gh api /repos/actions/github-script/git/ref/tags/v9 --jq /usr/bin/git /ref/tags/v9.0.0infocmp /tmp/go-build402-1 sv git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v0.1.2 --jq [.object.sha, .object.type] | @tsv /repos/actions/github-script/git/ref/tags/v9 --jq /usr/bin/gh Onlymin-integritgh on ache/go/1.25.8/x/repos/actions/github-script/git/ref/tags/v9 gh api /repos/actions/github-script/git/ref/tags/v9 --jq /usr/bin/git npx prettier --winfocmp git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v0.1.2 --jq [.object.sha, .object.type] | @tsv /repos/actions/github-script/git/ref/tags/v9 --jq /usr/bin/gh /ref/tags/v9 nomaly.go sv gh api /repos/actions/github-script/git/ref/tags/v9 --jq /usr/bin/git -w pkg/workflow/cal-1 ache/node/24.14.xterm-color git (http block)
  • https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.0.0 --jq [.object.sha, .object.type] | @tsv No expressions here x_amd64/vet /usr/bin/unpigz .js' --ignore-pagit --get x_amd64/vet /usr/bin/unpigz -d -c x_amd64/vet /usr/bin/git ed-imports-enablgit --local 64/pkg/tool/linu--show-toplevel git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.0.0 --jq [.object.sha, .object.type] | @tsv /usr/bin/git infocmp (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.0.0 --jq [.object.sha, .object.type] | @tsv (http block)
  • https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.2.3
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.2.3 --jq [.object.sha, .object.type] | @tsv xterm-color /tmp/go-build402929814/b464/_testmain.go /usr/bin/git b.github-app.pergit (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.2.3 --jq [.object.sha, .object.type] | @tsv --show-toplevel gh (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.2.3 --jq [.object.sha, .object.type] | @tsv /ref/tags/v9 x_amd64/asm sv /ref/tags/v9 git sv git -C /ref/tags/v9 show sv --show-toplevel git /usr/bin/git git (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs
    • Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --limit 100 --created >=2026-04-30 (http block)
    • Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --limit 100 --created >=2026-04-07 (http block)
    • Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --limit 100 --created >=2026-02-06 (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/1/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/1/artifacts --jq .artifacts[].name d/gh-aw/capitalization_test.go ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet /../../.prettiergh (http block)
    • Triggering command: /usr/bin/gh gh run download 1 --dir test-logs/run-1 929814/b019/vet.cfg cfg ./../.prettieriggit (http block)
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/1/artifacts --jq .artifacts[].name --jq 64/pkg/tool/linux_amd64/compile --show-toplevel git /usr/bin/git 64/pkg/tool/linux_amd64/compile push�� _.a origin ache/node/24.14.1/x64/lib/node_modules/npm/node_-nilfunc ./../.prettieriggit git /usr/bin/git sh (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/12345/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12345/artifacts --jq .artifacts[].name on x_amd64/vet /../../.prettiergit erignore (http block)
    • Triggering command: /usr/bin/gh gh run download 12345 --dir test-logs/run-12345 on x_amd64/link /../../.prettiergit erignore (http block)
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12345/artifacts --jq .artifacts[].name git n-dir/node --show-toplevel git (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/1234567890
    • Triggering command: /usr/bin/gh gh api repos/{owner}/{repo}/actions/runs/1234567890 --jq {databaseId: .id, number: .run_number, url: .html_url, status: .status, conclusion: .conclusion, workflowName: .name, workflowPath: .path, createdAt: .created_at, startedAt: .run_started_at, updatedAt: .updated_at, event: .event, headBranch: .head_branch, (http block)
    • Triggering command: /usr/bin/gh gh api repos/{owner}/{repo}/actions/runs/1234567890 --jq {databaseId: .id, number: .run_number, url: .html_url, status: .status, conclusion: .conclusion, workflowName: .name, workflowPath: .path, createdAt: .created_at, startedAt: .run_started_at, updatedAt: .updated_at, event: .event, headBranch: .head_branch, h ../../../.prettierignore git es/.bin/sh ithub-script/git/opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/vet git bject.type] | @t-bool gh api ../pkg/workflow/-errorsas --jq /usr/bin/infocmp-nilfunc --show-toplevel /usr/bin/git /usr/bin/git infocmp (http block)
    • Triggering command: /usr/bin/gh gh api repos/{owner}/{repo}/actions/runs/1234567890 --jq {databaseId: .id, number: .run_number, url: .html_url, status: .status, conclusion: .conclusion, workflowName: .name, workflowPath: .path, createdAt: .created_at, startedAt: .run_started_at, updatedAt: .updated_at, event: .event, headBranch: .head_branch, h ../../../.prettierignore git (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/12346/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12346/artifacts --jq .artifacts[].name on 64/pkg/tool/linux_amd64/compile /../../.prettiergit erignore (http block)
    • Triggering command: /usr/bin/gh gh run download 12346 --dir test-logs/run-12346 on 64/pkg/tool/linux_amd64/link /../../.prettiergit erignore (http block)
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12346/artifacts --jq .artifacts[].name --jq x86_64/node ithub-script/gitgit git bject.type] | @t--show-toplevel sh tion�� git status --porcelain --ignore-submodules | head -n 10 git 64/pkg/tool/linux_amd64/vet ignore git /usr/bin/git 64/pkg/tool/linuTest User (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/2/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/2/artifacts --jq .artifacts[].name on ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile /../../.prettier/usr/bin/git erignore (http block)
    • Triggering command: /usr/bin/gh gh run download 2 --dir test-logs/run-2 929814/b016/vet.cfg ache/go/1.25.8/x64/pkg/tool/linux_amd64/link (http block)
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/2/artifacts --jq .artifacts[].name git 64/pkg/tool/linux_amd64/vet /ref/tags/v9 git sv 64/pkg/tool/linu--json push�� artifacts-summar--limit origin in/node ./../.prettieriggit git /usr/bin/git sh (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/3/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/3/artifacts --jq .artifacts[].name on ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet /../../.prettierinfocmp erignore (http block)
    • Triggering command: /usr/bin/gh gh run download 3 --dir test-logs/run-3 929814/b024/vet.cfg ache/go/1.25.8/x64/pkg/tool/linu-test.short=true ./../.prettieriggit tdrain_test (http block)
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/3/artifacts --jq .artifacts[].name infocmp 64/pkg/tool/linux_amd64/link xterm-color git (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/4/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/4/artifacts --jq .artifacts[].name on ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet /../../.prettiergh erignore (http block)
    • Triggering command: /usr/bin/gh gh run download 4 --dir test-logs/run-4 o ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/4/artifacts --jq .artifacts[].name git 64/pkg/tool/linux_amd64/vet /ref/tags/v9 git sv 64/pkg/tool/linux_amd64/vet push�� mpiledOutput2180098345/001 origin k/node_modules/.bin/node ./../.prettieriggit git /usr/bin/basenamadd sh (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/5/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/5/artifacts --jq .artifacts[].name on ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet /../../.prettier/usr/bin/git erignore (http block)
    • Triggering command: /usr/bin/gh gh run download 5 --dir test-logs/run-5 929814/b020/vet.cfg cfg ./../.prettieriggit (http block)
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/5/artifacts --jq .artifacts[].name --jq l_url, status: .status, conclusion: .conclusion, workflowName: .name, workflowPath: .path, creat--show-toplevel /repos/actions/g/usr/bin/git --jq /usr/bin/git 64/pkg/tool/linux_amd64/vet e=/t�� mpiledOutput2180098345/001 m0s e_modules/.bin/node feOutputsAppTokegit git (http block)
  • https://api.github.com/repos/github/gh-aw/actions/workflows
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path (http block)
    • Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 100 (http block)
    • Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 6 -d (http block)
  • https://api.github.com/repos/github/gh-aw/contents/.github/workflows/shared/reporting.md
    • Triggering command: /tmp/go-build402929814/b405/cli.test /tmp/go-build402929814/b405/cli.test -test.testlogfile=/tmp/go-build402929814/b405/testlog.txt -test.paniconexit0 -test.v=true -test.parallel=4 -test.timeout=10m0s -test.run=^Test -test.short=true (http block)
    • Triggering command: /tmp/go-build819647325/b405/cli.test /tmp/go-build819647325/b405/cli.test -test.testlogfile=/tmp/go-build819647325/b405/testlog.txt -test.paniconexit0 -test.v=true -test.parallel=4 -test.timeout=10m0s -test.run=^Test -test.short=true --show-toplevel ache/go/1.25.8/x-c /usr/bin/infocmp"prettier" --write '**/*.cjs' '**/*.ts' '**/*.json' --ignore-path ../../../.pret.prettierignore git rev-�� --show-toplevel infocmp odules/npm/node_modules/@npmcli/run-script/lib/node-gyp-bin/sh xterm-color yBpCOKnpqA8jz/hy-c (http block)
    • Triggering command: /tmp/go-build1351191108/b405/cli.test /tmp/go-build1351191108/b405/cli.test -test.testlogfile=/tmp/go-build1351191108/b405/testlog.txt -test.paniconexit0 -test.v=true -test.parallel=4 -test.timeout=10m0s -test.run=^Test -test.short=true /ref/tags/v9 --jq sv infocmp -1 xterm-color gh /usr/bin/gh /repos/actions/gnode --jq /usr/bin/git gh (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v0.47.4
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v0.47.4 --jq [.object.sha, .object.type] | @tsv --show-toplevel git /usr/bin/git /tmp/compile-alldu show rue,"errors":[],/tmp/gh-aw/aw-feature-branch.patch git rev-�� /ref/tags/v9 /usr/bin/git sv -v (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v0.47.4 --jq [.object.sha, .object.type] | @tsv --show-toplevel git /usr/bin/git user.name Test User om/owner/repo.giHEAD git rev-�� /ref/tags/v9 git sv /ref/tags/v9 rev-parse sv git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v0.47.4 --jq [.object.sha, .object.type] | @tsv --show-toplevel git /usr/bin/git runs/20260507-03du rev-parse rue,"errors":[],/tmp/gh-aw/aw-feature-branch.patch git rev-�� --show-toplevel git /usr/bin/infocmp (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq [.object.sha, .object.type] | @tsv fClWxIkm0 --write ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet **/*.ts **/*.json --ignore-path ache/go/1.25.8/x64/pkg/tool/linutest@example.com rtcf�� npx prettier --write '../../../**/*.json' '!../../../pkg/workflo-errorsas tmain.go ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq [.object.sha, .object.type] | @tsv /ref/tags/v9.0.0 git sv /ref/tags/v9 git sv node k/gh�� --write **/*.cjs ache/node/24.14.1/x64/bin/node **/*.json --ignore-path erignore sh (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq [.object.sha, .object.type] | @tsv e=false git in/node --show-toplevel %H %ct %D (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.2.3
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq [.object.sha, .object.type] | @tsv Gitmain_branch32-s Gitmain_branch32-w x_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq [.object.sha, .object.type] | @tsv json' --ignore-p--detach --jq bject.type] | @tsv /repos/actions/gnode --jq /usr/bin/gh git phen�� th .prettierignore --log-level=error gh odules/npm/node_modules/@npmcli/run-script/lib/node-gyp-bin/node /repos/actions/ginfocmp --jq /usr/bin/infocmpxterm-color pins synced successfully"; \ else \ echo "��� (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq [.object.sha, .object.type] | @tsv /ref/tags/v9 git sh --show-toplevel /usr/bin/git (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v2.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq [.object.sha, .object.type] | @tsv 70277277/001 70277277/002/work x_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq [.object.sha, .object.type] | @tsv .js' --ignore-path .prettierignore --log-level=e!../../../pkg/workflow/js/**/*.json --get x_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq [.object.sha, .object.type] | @tsv .js' --ignore-path .prettierigno-errorsas --get x_amd64/vet (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v3.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq [.object.sha, .object.type] | @tsv on_test.go edentials_test.go x_amd64/vet ator.go ion_test.go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq [.object.sha, .object.type] | @tsv json' --ignore-path ../../../.pr**/*.json git 1/x64/bin/npm ithub-script/gitgit git bject.type] | @t/tmp/gh-aw-test-runs/20260507-035425-27218/test-3676393127/.github/workflows git rev-�� y-test.md git cal/bin/sh --show-toplevel git /usr/bin/git git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq [.object.sha, .object.type] | @tsv --show-toplevel git /usr/bin/git --show-toplevel gh (http block)
  • https://api.github.com/repos/google-github-actions/auth/git/ref/tags/v2
    • Triggering command: /usr/bin/gh gh api /repos/google-github-actions/auth/git/ref/tags/v2 --jq [.object.sha, .object.type] | @tsv --show-toplevel git /usr/bin/git /tmp/TestGuardPogit rev-parse /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git /tmp/gh-aw-test-git remote om/myorg/repo.gi--show-toplevel git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/google-github-actions/auth/git/ref/tags/v2 --jq [.object.sha, .object.type] | @tsv --show-toplevel git /usr/bin/git ons-test35548266git git ow-without-react--show-toplevel git rev-�� (http block)
    • Triggering command: /usr/bin/gh gh api /repos/google-github-actions/auth/git/ref/tags/v2 --jq [.object.sha, .object.type] | @tsv --show-toplevel git /usr/bin/git ons-test38030540git config /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --get remote.origin.urrev-parse om/owner/repo.gi--show-toplevel git (http block)
  • https://api.github.com/repos/nonexistent/action/git/ref/tags/v999.999.999
    • Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq [.object.sha, .object.type] | @tsv 3451931227 929814/b169/vet.cfg 64/pkg/tool/linux_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq [.object.sha, .object.type] | @tsv -x c ck - git /usr/bin/git node sRem�� --write **/*.cjs k/gh-aw/gh-aw/actions/setup/js/node_modules/.bin/sh **/*.json --ignore-path erignore sh (http block)
    • Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq [.object.sha, .object.type] | @tsv 1263246582 --jq $name) { hasDiscussionsEnabled } } /ref/tags/v9 %H %ct %D (http block)
  • https://api.github.com/repos/nonexistent/repo/actions/runs/12345
    • Triggering command: /usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion (http block)
    • Triggering command: /usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion ithub-script/gitgit git bject.type] | @t--show-toplevel /opt/hostedtoolcache/go/1.25.8/xconfig (http block)
    • Triggering command: /usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion son git 0c20ebfae6de4231--show-toplevel infocmp -1 thub/workflows git nfig/composer/vendor/bin/sh nore git /usr/bin/git git (http block)
  • https://api.github.com/repos/owner/repo/actions/workflows
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo it/copilot-hooks hub.com/.extrahe/opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo it/copilot-hooks-nilfunc hub.com/.extrahe/opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh workflow list --repo owner/repo --json name,path,state _.a (http block)
  • https://api.github.com/repos/test-owner/test-repo/actions/secrets
    • Triggering command: /usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name on' --ignore-path ../../../.prettierignore (http block)
    • Triggering command: /usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name h ../../../.prettierignore git modules/@npmcli/run-script/lib/node-gyp-bin/sh --show-toplevel git /usr/bin/git git rev-�� w/js/**/*.json' --ignore-path git 64/bin/bash --show-toplevel infocmp /usr/bin/git git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name h ../../../.prettierignore --jq /usr/bin/git --show-toplevel git /usr/bin/git git rev-�� w/js/**/*.json' --ignore-path git sv --show-toplevel git (http block)
  • https://api.github.com/repos/test/repo
    • Triggering command: /usr/bin/gh gh api /repos/test/repo --jq .default_branch ngutil.test tmain.go rtcfg.link o (http block)
    • Triggering command: /usr/bin/gh gh api /repos/test/repo --jq .default_branch OKEN }} **/*.cjs k/gh-aw/gh-aw/actions/setup/node_modules/.bin/sh **/*.json --ignore-path erignore sh -c 5425-27218/test-656248786/.githu@{u} -pack (http block)
    • Triggering command: /usr/bin/gh gh api /repos/test/repo --jq .default_branch (http block)

If you need me to access, download, or install something from one of these locations, you can either:

Copilot AI and others added 2 commits May 7, 2026 03:55
Copilot AI changed the title [WIP] Fix safe-outputs: update-project permission regression in App token Preserve issues: write in safe-outputs App token when update-project is co-configured May 7, 2026
Copilot AI requested a review from pelikhan May 7, 2026 03:59
@pelikhan pelikhan marked this pull request as ready for review May 7, 2026 04:11
Copilot AI review requested due to automatic review settings May 7, 2026 04:13
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Fixes a regression in safe-outputs permission aggregation where co-configuring update-project/create-project with handlers that require issues: write could incorrectly downgrade the computed GitHub App token permissions to issues: read, causing issue mutations to fail.

Changes:

  • Updated ComputePermissionsForSafeOutputs to only set issues: read for project handlers when issues: write is not already required.
  • Added a permissions-model unit test covering add-comment + add-labels + update-project to ensure issues: write is preserved alongside organization-projects: write.
  • Added a compiled safe-outputs App token/job regression test verifying the minted token inputs and job-level permissions keep issues: write when update-project is present.
Show a summary per file
File Description
pkg/workflow/safe_outputs_permissions.go Prevents project handlers from downgrading an already-required issues: write to read during permission aggregation.
pkg/workflow/safe_outputs_permissions_test.go Adds a targeted unit test asserting correct permission union semantics for add-comment + add-labels + update-project.
pkg/workflow/safe_outputs_app_test.go Adds a regression test validating compiled workflow/job output preserves issues: write in the minted App token inputs and job permissions.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

  • Files reviewed: 3/3 changed files
  • Comments generated: 0

@pelikhan pelikhan merged commit bae228d into main May 7, 2026
4 checks passed
@pelikhan pelikhan deleted the copilot/fix-safe-outputs-permission-issue branch May 7, 2026 06:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

safe-outputs: update-project co-presence regresses handler-derived issues:write to issues:read in minted App token

3 participants