ValidateIncludedPermissions validates that the main workflow permissions satisfy the imported workflow requirements. This function is specifically used when merging included/imported workflow files to ensure the main workflow has sufficient permissions to support all imported files. Use ValidatePer
(topPermissionsYAML string, importedPermissionsJSON string)
| 260 | // GitHub MCP toolsets. Use ValidateIncludedPermissions (this function) when validating permissions |
| 261 | // from included/imported workflow files. |
| 262 | func (c *Compiler) ValidateIncludedPermissions(topPermissionsYAML string, importedPermissionsJSON string) error { |
| 263 | permissionsValidationLog.Print("Validating included workflow permissions") |
| 264 | |
| 265 | // If no imported permissions, no validation needed |
| 266 | if importedPermissionsJSON == "" || importedPermissionsJSON == "{}" { |
| 267 | permissionsValidationLog.Print("No included workflow permissions to validate") |
| 268 | return nil |
| 269 | } |
| 270 | |
| 271 | // Parse top-level permissions |
| 272 | var topPerms *Permissions |
| 273 | if topPermissionsYAML != "" { |
| 274 | topPerms = NewPermissionsParser(topPermissionsYAML).ToPermissions() |
| 275 | } else { |
| 276 | topPerms = NewPermissions() |
| 277 | } |
| 278 | |
| 279 | // Track missing permissions |
| 280 | missingPermissions := make(map[PermissionScope]PermissionLevel) |
| 281 | insufficientPermissions := make(map[PermissionScope]struct { |
| 282 | required PermissionLevel |
| 283 | current PermissionLevel |
| 284 | }) |
| 285 | |
| 286 | // Split by newlines to handle multiple JSON objects from different imports |
| 287 | lines := strings.Split(importedPermissionsJSON, "\n") |
| 288 | permissionsValidationLog.Printf("Processing %d permission definition lines", len(lines)) |
| 289 | |
| 290 | for _, line := range lines { |
| 291 | line = strings.TrimSpace(line) |
| 292 | if line == "" || line == "{}" { |
| 293 | continue |
| 294 | } |
| 295 | |
| 296 | // Parse JSON line to permissions map |
| 297 | var importedPermsMap map[string]any |
| 298 | if err := json.Unmarshal([]byte(line), &importedPermsMap); err != nil { |
| 299 | permissionsValidationLog.Printf("Skipping malformed permission entry: %q (error: %v)", line, err) |
| 300 | continue |
| 301 | } |
| 302 | |
| 303 | // Check each permission from the imported map |
| 304 | for scopeStr, levelValue := range importedPermsMap { |
| 305 | scope := PermissionScope(scopeStr) |
| 306 | |
| 307 | // Parse the level - it might be a string or already unmarshaled |
| 308 | var requiredLevel PermissionLevel |
| 309 | if levelStr, ok := levelValue.(string); ok { |
| 310 | requiredLevel = PermissionLevel(levelStr) |
| 311 | } else { |
| 312 | // Skip invalid level values |
| 313 | continue |
| 314 | } |
| 315 | |
| 316 | // Get current level for this scope |
| 317 | currentLevel, exists := topPerms.Get(scope) |
| 318 | |
| 319 | // Validate that the main workflow has sufficient permissions |