expandDefaultToolset expands "default" and "action-friendly" keywords to individual toolsets. This ensures that "default" and "action-friendly" in the source expand to action-friendly toolsets (excluding "users" which GitHub Actions tokens don't support).
(toolsetsStr string)
| 211 | // This ensures that "default" and "action-friendly" in the source expand to action-friendly toolsets |
| 212 | // (excluding "users" which GitHub Actions tokens don't support). |
| 213 | func expandDefaultToolset(toolsetsStr string) string { |
| 214 | if toolsetsStr == "" { |
| 215 | return strings.Join(ActionFriendlyGitHubToolsets, ",") |
| 216 | } |
| 217 | |
| 218 | // Split by comma and check if "default" or "action-friendly" is present |
| 219 | toolsets := strings.Split(toolsetsStr, ",") |
| 220 | var result []string |
| 221 | seenToolsets := make(map[string]struct { |
| 222 | }) |
| 223 | |
| 224 | for _, toolset := range toolsets { |
| 225 | toolset = strings.TrimSpace(toolset) |
| 226 | if toolset == "" { |
| 227 | continue |
| 228 | } |
| 229 | |
| 230 | if toolset == "default" || toolset == "action-friendly" { |
| 231 | githubConfigLog.Printf("Expanding %q keyword to action-friendly toolsets", toolset) |
| 232 | // Expand "default" or "action-friendly" to action-friendly toolsets (excludes "users") |
| 233 | for _, dt := range ActionFriendlyGitHubToolsets { |
| 234 | if !setutil.Contains(seenToolsets, dt) { |
| 235 | result = append(result, dt) |
| 236 | seenToolsets[dt] = struct { |
| 237 | }{} |
| 238 | } |
| 239 | } |
| 240 | } else { |
| 241 | // Keep other toolsets as-is (including "all", individual toolsets, etc.) |
| 242 | if !setutil.Contains(seenToolsets, toolset) { |
| 243 | result = append(result, toolset) |
| 244 | seenToolsets[toolset] = struct { |
| 245 | }{} |
| 246 | } |
| 247 | } |
| 248 | } |
| 249 | |
| 250 | return strings.Join(result, ",") |
| 251 | } |
| 252 | |
| 253 | // getGitHubAllowedTools extracts the allowed tools list from GitHub tool configuration |
| 254 | // Returns the list of allowed tools, or nil if no allowed list is specified (which means all tools are allowed) |