Conversation
… dependabot toolset compilation The compiler was incorrectly requiring `vulnerability-alerts: read` as a workflow-level permission when using the `dependabot` toolset (directly or via `toolsets: all`). This is a GitHub App-only scope that cannot be set at the GITHUB_TOKEN/workflow level. Fix: Filter out GitHub App-only permission scopes in `collectRequiredPermissions` so they are not included in the workflow-level permission requirements. This unblocks 6 affected workflows that were failing to compile: - daily-firewall-report.md - deep-report.md - dependabot-go-checker.md - github-mcp-structural-analysis.md - github-mcp-tools-report.md - security-review.md Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> Agent-Logs-Url: https://github.com/github/gh-aw/sessions/44690a38-5e56-4478-8a68-6d8bf5a9b386
Copilot
AI
changed the title
[WIP] Fix compiler issues due to missing vulnerability-alerts permission
fix: skip GitHub App-only scopes in toolset permission validation
Mar 25, 2026
Contributor
|
@copilot remove dependabot from "all" toolset |
Contributor
There was a problem hiding this comment.
Pull request overview
Fixes workflow permission validation for GitHub toolsets by excluding GitHub App-only scopes (e.g., vulnerability-alerts) from GITHUB_TOKEN permission requirements, preventing invalid workflow permissions: expectations for toolsets: all / dependabot.
Changes:
- Update
collectRequiredPermissionsto skip GitHub App-only permission scopes when aggregating required workflow permissions. - Adjust
dependabottoolset unit test expectations to require onlysecurity-eventsat the workflow permission level.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| pkg/workflow/permissions_toolset_data.go | Filters out GitHub App-only scopes from toolset-derived workflow permission requirements. |
| pkg/workflow/permissions_validator_test.go | Updates the dependabot toolset test case to align with the new filtering behavior. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+112
to
+113
| // Skip GitHub App-only permission scopes; these cannot be set via GITHUB_TOKEN | ||
| // and are validated separately in validateGitHubAppOnlyPermissions. |
There was a problem hiding this comment.
The comment here implies these GitHub App-only scopes are "validated separately in validateGitHubAppOnlyPermissions", but that validator only checks explicitly declared workflow permissions and doesn’t validate toolset-derived requirements. Consider rewording to clarify the real behavior (App-only scopes are not valid for GITHUB_TOKEN/job permissions, are filtered from rendered workflow permissions, and are only validated when explicitly declared for GitHub App token minting).
Suggested change
| // Skip GitHub App-only permission scopes; these cannot be set via GITHUB_TOKEN | |
| // and are validated separately in validateGitHubAppOnlyPermissions. | |
| // Skip GitHub App-only permission scopes; these are not valid for GITHUB_TOKEN/job | |
| // permissions, are excluded from toolset-derived workflow permissions, and are only | |
| // validated when explicitly declared for GitHub App token minting. |
Dependabot toolset requires GitHub App-only permissions (vulnerability-alerts) that cannot be granted via GITHUB_TOKEN. Workflows using `toolsets: all` should not inadvertently pull in the dependabot toolset — users must opt in explicitly with `toolsets: [default, dependabot]` and configure a GitHub App. Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> Agent-Logs-Url: https://github.com/github/gh-aw/sessions/d7e286c6-e1be-40da-852c-7a616d322b7c
Contributor
Author
Done in ba23156. Added Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
Copilot
AI
changed the title
fix: skip GitHub App-only scopes in toolset permission validation
fix: skip GitHub App-only scopes in toolset permission validation and exclude dependabot from "all"
Mar 25, 2026
This was referenced Mar 25, 2026
github-actions bot
added a commit
that referenced
this pull request
Mar 25, 2026
…idation - cli.md: expand gh aw audit description with the new report sections added in #22932 (engine config, prompt analysis, session & agent performance, MCP server health, safe output summary) - github-tools.md: document toolsets shorthand values (default, all) and add a note that toolsets: [all] excludes dependabot (#22851) - triggers.md: document compile-time glob pattern validation for push/ pull_request/pull_request_target/workflow_run filter fields (#22873) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
pelikhan
pushed a commit
that referenced
this pull request
Mar 25, 2026
…idation (#22972) - cli.md: expand gh aw audit description with the new report sections added in #22932 (engine config, prompt analysis, session & agent performance, MCP server health, safe output summary) - github-tools.md: document toolsets shorthand values (default, all) and add a note that toolsets: [all] excludes dependabot (#22851) - triggers.md: document compile-time glob pattern validation for push/ pull_request/pull_request_target/workflow_run filter fields (#22873) Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
collectRequiredPermissionswas includingvulnerability-alertsin the required workflow permissions for thedependabottoolset. Sincevulnerability-alertsis a GitHub App-only scope—not a validGITHUB_TOKENpermission—this caused compilation failures for any workflow usingtoolsets: allordependabot, even without a GitHub App configured.Changes
pkg/workflow/permissions_toolset_data.go: Filter out GitHub App-only scopes incollectRequiredPermissions. These cannot appear in a workflowpermissions:block and are already validated independently byvalidateGitHubAppOnlyPermissions.pkg/workflow/github_toolsets.go: AddedGitHubToolsetsExcludedFromAlllist and updatedParseGitHubToolsetsto skipdependabotwhen expandingall. Thedependabottoolset requires GitHub App-only permissions (vulnerability-alerts) that cannot be granted viaGITHUB_TOKEN, so it must be opted in to explicitly (e.g.,toolsets: [default, dependabot]) alongside a configured GitHub App.pkg/workflow/permissions_validator_test.go: Updatedependabottoolset test to expect onlysecurity-events(notvulnerability-alerts) at the workflow permission level.pkg/workflow/github_toolsets_test.goandpkg/workflow/github_tool_to_toolset_test.go: Updated tests to reflect thatallno longer includesdependabot.This unblocks recompilation of 6 workflows that were silently running on stale lock files:
daily-firewall-report,deep-report,dependabot-go-checker,github-mcp-structural-analysis,github-mcp-tools-report, andsecurity-review.📱 Kick off Copilot coding agent tasks wherever you are with GitHub Mobile, available on iOS and Android.