Fix test suite for GitHub MCP toolset permission validation

pkg/cli/commands_compile_workflow_test.go

@@ -28,6 +28,8 @@ on:
     branches: [main]
 permissions:
   contents: read
+  issues: read
+  pull-requests: read
 ---
 
 # Test Workflow
@@ -58,6 +60,8 @@ on:
     - cron: "0 9 * * 1"
 permissions:
   contents: write
+  issues: read
+  pull-requests: read
 ---
 
 # Verbose Test Workflow
@@ -88,6 +92,8 @@ on:
     branches: [main]
 permissions:
   contents: read
+  issues: read
+  pull-requests: read
 ---
 
 # Engine Override Test
@@ -421,6 +427,8 @@ on:
     branches: [main]
 permissions:
   contents: read
+  issues: read
+  pull-requests: read
 ---
 
 # Test Workflow
@@ -460,6 +468,8 @@ on:
     branches: [main]
 permissions:
   contents: read
+  issues: read
+  pull-requests: read
 ---
 
 # Test Workflow

pkg/cli/commands_test.go

@@ -143,6 +143,8 @@ on:
   workflow_dispatch:
 permissions:
   contents: read
+  issues: read
+  pull-requests: read
 ---
 
 # Test Workflow for No Emit

pkg/cli/compile_dependabot_test.go

@@ -37,6 +37,8 @@ func TestCompileDependabotIntegration(t *testing.T) {
 on: push
 permissions:
   contents: read
+  issues: read
+  pull-requests: read
 steps:
   - run: npx @playwright/mcp@latest --help
 ---
@@ -159,6 +161,8 @@ func TestCompileDependabotNoDependencies(t *testing.T) {
 on: push
 permissions:
   contents: read
+  issues: read
+  pull-requests: read
 ---
 
 # Test Workflow
@@ -239,6 +243,8 @@ func TestCompileDependabotPreserveExisting(t *testing.T) {
 on: push
 permissions:
   contents: read
+  issues: read
+  pull-requests: read
 steps:
   - run: npx @playwright/mcp@latest --help
 ---
@@ -348,6 +354,8 @@ func TestCompileDependabotMergeExistingNpm(t *testing.T) {
 on: push
 permissions:
   contents: read
+  issues: read
+  pull-requests: read
 steps:
   - run: npx @playwright/mcp@latest --help
 ---

pkg/cli/compile_instructions_test.go

@@ -51,6 +51,8 @@ func TestCompileDoesNotWriteInstructions(t *testing.T) {
 on: workflow_dispatch
 permissions:
   contents: read
+  issues: read
+  pull-requests: read
 engine: claude
 ---
 
@@ -153,6 +155,8 @@ func TestCompileDoesNotWriteInstructionsWhenCompilingAll(t *testing.T) {
 on: workflow_dispatch
 permissions:
   contents: read
+  issues: read
+  pull-requests: read
 engine: claude
 ---
 

pkg/workflow/action_sha_validation_test.go

@@ -19,7 +19,8 @@ on: push
 engine: copilot
 permissions:
   contents: read
----
+  issues: read
+  pull-requests: read
 
 # Test Workflow
 This is a test workflow to verify SHA pinning.
@@ -84,6 +85,7 @@ engine: copilot
 permissions:
   contents: read
   issues: write
+  pull-requests: read
 safe-outputs:
   create-issue:
 ---
@@ -143,7 +145,8 @@ on: push
 engine: copilot
 permissions:
   contents: read
----
+  issues: read
+  pull-requests: read
 
 # Simple Test
 Just a simple test workflow.

pkg/workflow/agentic_output_test.go

@@ -24,6 +24,7 @@ on: push
 permissions:
   contents: read
   issues: write
+  pull-requests: read
 tools:
   github:
     allowed: [list_issues]
@@ -123,6 +124,7 @@ on: push
 permissions:
   contents: read
   issues: write
+  pull-requests: read
 tools:
   github:
     allowed: [list_issues]
@@ -245,6 +247,8 @@ func TestEngineOutputCleanupExcludesTmpFiles(t *testing.T) {
 on: push
 permissions:
   contents: read
+  issues: read
+  pull-requests: read
 tools:
   github:
     allowed: [list_issues]

pkg/workflow/allowed_domains_sanitization_test.go

@@ -22,6 +22,8 @@ func TestAllowedDomainsFromNetworkConfig(t *testing.T) {
 on: push
 permissions:
   contents: read
+  issues: read
+  pull-requests: read
 engine: copilot
 network:
   allowed:
@@ -52,6 +54,8 @@ Test workflow with network permissions.
 on: push
 permissions:
   contents: read
+  issues: read
+  pull-requests: read
 engine: claude
 network:
   allowed:
@@ -78,6 +82,8 @@ Test workflow with network permissions.
 on: push
 permissions:
   contents: read
+  issues: read
+  pull-requests: read
 engine: copilot
 network: defaults
 safe-outputs:
@@ -104,6 +110,8 @@ Test workflow with defaults network.
 on: push
 permissions:
   contents: read
+  issues: read
+  pull-requests: read
 engine: copilot
 safe-outputs:
   create-issue:
@@ -128,6 +136,8 @@ Test workflow without network config.
 on: push
 permissions:
   contents: read
+  issues: read
+  pull-requests: read
 engine: claude
 network:
   allowed:
@@ -234,6 +244,8 @@ func TestManualAllowedDomainsHasPriority(t *testing.T) {
 on: push
 permissions:
   contents: read
+  issues: read
+  pull-requests: read
 engine: copilot
 network:
   allowed:
@@ -263,6 +275,8 @@ Test that manual allowed-domains takes precedence.
 on: push
 permissions:
   contents: read
+  issues: read
+  pull-requests: read
 engine: copilot
 network:
   allowed:

pkg/workflow/aw_info_steps_test.go

@@ -20,6 +20,8 @@ func TestAwInfoStepsFirewall(t *testing.T) {
 on: push
 permissions:
   contents: read
+  issues: read
+  pull-requests: read
 engine: copilot
 network:
   firewall: true
@@ -38,6 +40,8 @@ This workflow tests that firewall type is set to squid when enabled.
 on: push
 permissions:
   contents: read
+  issues: read
+  pull-requests: read
 engine: copilot
 network:
   firewall: false
@@ -56,6 +60,8 @@ This workflow tests that firewall type is empty when disabled.
 on: push
 permissions:
   contents: read
+  issues: read
+  pull-requests: read
 engine: claude
 ---
 

pkg/workflow/aw_info_tmp_test.go

@@ -21,6 +21,7 @@ on: push
 permissions:
   contents: read
   issues: write
+  pull-requests: read
 tools:
   github:
     allowed: [list_issues]

pkg/workflow/cache_memory_import_test.go

@@ -41,6 +41,8 @@ name: Test Import Only
 on: workflow_dispatch
 permissions:
   contents: read
+  issues: read
+  pull-requests: read
 engine: claude
 imports:
   - shared/cache-config.md

pkg/workflow/cache_memory_integration_test.go

@@ -21,6 +21,8 @@ name: Test Cache Memory Single
 on: workflow_dispatch
 permissions:
   contents: read
+  issues: read
+  pull-requests: read
 engine: claude
 tools:
   cache-memory: true
@@ -52,6 +54,8 @@ name: Test Cache Memory Multiple
 on: workflow_dispatch
 permissions:
   contents: read
+  issues: read
+  pull-requests: read
 engine: claude
 tools:
   cache-memory:
@@ -93,6 +97,8 @@ name: Test Cache Memory Multiple No Keys
 on: workflow_dispatch
 permissions:
   contents: read
+  issues: read
+  pull-requests: read
 engine: claude
 tools:
   cache-memory: