Handle PR #27837 review comments for create-project issues permissions

[Copilot]

• Inspect PR Add issues: read to update-project GitHub App token permissions #27837 review comments and confirm required follow-up scope
• Run baseline validation before edits and note unrelated pre-existing failures
• Update safe-output permission computation to cover create-project issue resolution path
• Add/adjust unit tests for create-project permission behavior and app token minting inputs
• Update safe-outputs documentation to include create-project + item_url permission requirement
• Run targeted tests for changed files
• Run make agent-finish for pre-commit validation
• Remove unrelated lock-file changes from branch
• Commit and push changes

[Copilot]

Pull request overview

Updates safe-output permission computation and related tests/docs to ensure GitHub App tokens include issues: read when project operations may resolve issue-backed items (including the create-project path).

Changes:

• Add issues: read to the computed permissions for safe-outputs.create-project.
• Update unit tests to expect issues: read for create-project permissions and to assert minted app-token inputs include permission-issues: read.
• Expand safe-outputs reference docs to mention the issues: read requirement for issue-backed project item resolution (including create-project when item_url is used).

Show a summary per file

File	Description
pkg/workflow/safe_outputs_permissions.go	Adds issues: read to permissions computed for create-project.
pkg/workflow/safe_outputs_permissions_test.go	Updates create-project permission expectations to include issues: read.
pkg/workflow/safe_outputs_app_test.go	Adds a regression test asserting the minted GitHub App token includes permission-issues: read for create-project.
docs/src/content/docs/reference/safe-outputs.md	Documents the issues: read requirement for issue-backed project item resolution, including create-project with item_url.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 4/4 changed files
• Comments generated: 3

[Copilot]

ComputePermissionsForSafeOutputs now unconditionally adds issues: read when create-project is enabled. In actions/setup/js/create_project.cjs, issues access is only needed when item_url is provided (to resolve the issue node ID and add it to the project), so this expands the minted GitHub App token permissions even for create-project usages that never set item_url. Consider making this conditional (e.g., via an explicit config flag that enables item_url support) or updating the documentation to clarify that enabling create-project will always mint a token with issues: read due to the optional item_url feature.

[Copilot]

This test name/comment says create-project is configured "with item_url", but item_url is not part of the safe-outputs.create-project frontmatter config and the markdown fixture here does not (and cannot) express whether the agent will send an item_url at runtime. As written, the test is asserting that enabling create-project causes the app token minting step to include permission-issues: read unconditionally, so the test should be renamed/reworded to match what it actually validates.

[Copilot]

This note about create-project + item_url is placed under the update-project section, but the create-project section above is where users will look for create-project token requirements (especially since item_url is documented there). Consider duplicating/moving this guidance closer to the create-project documentation so the permission requirement isn’t missed.