Function buildWorkflowsScopeError

actions/setup/js/push_to_pull_request_branch.cjs:221–229

* Builds the typed result and logs actionable guidance when a branch push fails * because the token lacks the 'workflows' scope. * * @param {string} context - Short label identifying the push path (e.g. "Review branch", "Fallback branch") * @param {typeof core} coreLogger - Actions core logger

(context, coreLogger)

 * @returns {{ success: false, error_type: "workflows_scope_required", error: string }}
 */
function buildWorkflowsScopeError(context, coreLogger) {
  coreLogger.error(`${context} push rejected: the branch includes changes to workflow files (.github/workflows/**) that require the 'workflows' scope on the push token.`);
  coreLogger.error("To allow this workflow to push workflow file changes, configure 'push-to-pull-request-branch.allow-workflows: true' together with a GitHub App in 'safe-outputs.github-app'.");
  return {
    success: false,
    error_type: "workflows_scope_required",
    error: `${context} push rejected: the branch includes changes to workflow files (.github/workflows/**) requiring the 'workflows' scope. The token used for the safe-outputs checkout does not have this scope. Fix: configure 'push-to-pull-request-branch.allow-workflows: true' with a GitHub App in 'safe-outputs.github-app', or exclude workflow files from the changeset.`,
  };
}

/**
 * Main handler factory for push_to_pull_request_branch