(frontmatter map[string]any, toolsets []string)
| 94 | } |
| 95 | |
| 96 | func findMissingToolsetPermissions(frontmatter map[string]any, toolsets []string) map[workflow.PermissionScope]workflow.PermissionLevel { |
| 97 | permissionsParser := workflow.NewPermissionsParserFromValue(frontmatter["permissions"]) |
| 98 | currentPermissions := permissionsParser.ToPermissions() |
| 99 | validationResult := workflow.ValidatePermissions(currentPermissions, &workflow.GitHubToolConfig{}, toolsets) |
| 100 | if !validationResult.HasValidationIssues || len(validationResult.MissingPermissions) == 0 { |
| 101 | return nil |
| 102 | } |
| 103 | |
| 104 | missing := make(map[workflow.PermissionScope]workflow.PermissionLevel) |
| 105 | for scope, level := range validationResult.MissingPermissions { |
| 106 | // Skip GitHub App-only scopes: these are not grantable through workflow |
| 107 | // GITHUB_TOKEN permissions and require GitHub App token minting instead. |
| 108 | if workflow.IsGitHubAppOnlyScope(scope) { |
| 109 | continue |
| 110 | } |
| 111 | missing[scope] = level |
| 112 | } |
| 113 | return missing |
| 114 | } |
| 115 | |
| 116 | func ensureToolsetPermissions(lines []string, missing map[workflow.PermissionScope]workflow.PermissionLevel) ([]string, bool) { |
| 117 | if len(missing) == 0 { |
no test coverage detected