[plan] Add actions: read permission to activation job when hash check API step is emitted

[github-actions]

Context

Issue #24949 reports that the compiled activation job fails with Error: Resource not accessible by integration when the hash check step calls github.rest.actions.getWorkflowRun(). This requires the actions: read permission, but the compiler only emits contents: read in the activation job's permissions: block.

Root Cause

The compiler emits the check_workflow_timestamp_api.cjs step (which calls the Actions REST API) in the activation job, but does not add actions: read to the job's permissions:. Since GitHub Actions enforces explicit permissions when any permissions: block is present, the token lacks the required scope.

Required Fix

In the workflow compiler (likely in pkg/workflow/), when the check_workflow_timestamp_api.cjs step is emitted for the activation job:

1. Locate where the activation job's permissions: block is constructed
2. Add actions: read to the permissions map whenever the hash check API step is included

Search for the relevant code with:

grep -r "check_workflow_timestamp_api\|contents.*read\|ActivationPermissions" pkg/workflow/ --include="*.go" -l

Files to Modify

• The Go compiler file(s) in pkg/workflow/ that build the activation job YAML (look for contents: read, permissions, or check_workflow_timestamp_api references)

Acceptance Criteria

• Compiled activation job includes actions: read in its permissions: block when the hash check API step is present
• Existing test for activation job permissions is updated (or new test added) to assert actions: read is emitted
• No regression in same-org scenarios
  Related to Cross-org workflow_call: resolve_host_repo, checkout, and hash check all fail #24949

Generated by Plan Command for issue #24949 · ● 509.4K · ◷

• expires on Apr 8, 2026, 10:23 PM UTC

[github-actions]

🍪 Issue Monster has assigned this to Copilot!

I've identified this issue as a good candidate for automated resolution and assigned it to the Copilot coding agent.

The Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

Note

🔒 Integrity filter blocked 1 item

The following item were blocked because they don't meet the GitHub integrity level.

• Cross-org workflow_call: resolve_host_repo, checkout, and hash check all fail #24949 issue_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".

To allow these resources, lower min-integrity in your GitHub frontmatter:

tools:
  github:
    min-integrity: approved  # merged | approved | unapproved | none

🍪 Om nom nom by Issue Monster · ● 382.5K · ◷