addCopilotRequestsPermissionToContent injects `permissions.copilot-requests: write` into the workflow frontmatter, enabling GitHub Actions token auth for Copilot (org billing). It delegates to ensureCopilotRequestsWritePermission, which locates or creates the permissions block and appends the copilo
(content string)
| 891 | // Returns an error if the permission could not be injected and is not already present |
| 892 | // (e.g., when `permissions:` is a non-mapping scalar like `read-all`). |
| 893 | func addCopilotRequestsPermissionToContent(content string) (string, error) { |
| 894 | var injectionFailed bool |
| 895 | newContent, _, err := applyFrontmatterLineTransform(content, func(lines []string) ([]string, bool) { |
| 896 | updated := ensureCopilotRequestsWritePermission(lines) |
| 897 | // Detect whether ensureCopilotRequestsWritePermission actually made a change. |
| 898 | // When lengths differ, a line was added — modified is true without needing element comparison. |
| 899 | // When lengths are equal, compare element-by-element (safe since len(updated)==len(lines)). |
| 900 | modified := len(updated) != len(lines) |
| 901 | if !modified { |
| 902 | for i := range lines { |
| 903 | if lines[i] != updated[i] { |
| 904 | modified = true |
| 905 | break |
| 906 | } |
| 907 | } |
| 908 | } |
| 909 | if !modified { |
| 910 | // Lines unchanged — either the permission is already present (idempotent) or |
| 911 | // it could not be injected (e.g., `permissions:` is a scalar like `read-all`). |
| 912 | if !copilotRequestsPermissionPresentInLines(updated) { |
| 913 | injectionFailed = true |
| 914 | } |
| 915 | } |
| 916 | return updated, modified |
| 917 | }) |
| 918 | if injectionFailed { |
| 919 | return content, errors.New("cannot inject permissions.copilot-requests: write: 'permissions' is a non-mapping scalar value; update it manually") |
| 920 | } |
| 921 | if err != nil { |
| 922 | return content, err |
| 923 | } |
| 924 | return newContent, nil |
| 925 | } |
| 926 | |
| 927 | // copilotRequestsPermissionPresentInLines returns true when the frontmatter lines contain |
| 928 | // a `copilot-requests:` key (ignoring comment lines). It is used to distinguish the idempotent |