Method HasContentsReadAccess

pkg/workflow/permissions_operations.go:32–57

HasContentsReadAccess returns true if the permissions allow reading the repository contents. This is equivalent to PermissionsParser.HasContentsReadAccess but operates directly on the parsed Permissions struct to avoid redundant YAML parsing when CachedPermissions is available.

()

// This is equivalent to PermissionsParser.HasContentsReadAccess but operates directly on the
// parsed Permissions struct to avoid redundant YAML parsing when CachedPermissions is available.
func (p *Permissions) HasContentsReadAccess() bool {
	if p == nil {
		return false
	}

	if p.shorthand != "" {
		switch p.shorthand {
		case "read-all", "write-all":
			return true
		// "none" shorthand denies all access; any other unexpected value is also denied.
		default:
			return false
		}
	}
	// all: write implies write-level access on every scope, which includes read access.
	if p.hasAll && (p.allLevel == PermissionRead || p.allLevel == PermissionWrite) {
		if contentsLevel, exists := p.permissions[PermissionContents]; exists {
			return contentsLevel == PermissionRead || contentsLevel == PermissionWrite
		}
		return true
	}
	if contentsLevel, exists := p.permissions[PermissionContents]; exists {
		return contentsLevel == PermissionRead || contentsLevel == PermissionWrite
	}
	return false
}

// hasCopilotRequestsWritePermission returns true when workflow permissions include
// copilot-requests: write. This controls whether engines should use ${{ github.token }}