[WIP] Add missing organization-custom-org-roles and organization-custom-repository-roles to JSON Schema by Copilot · Pull Request #56982 · github/gh-aw

Copilot · 2026-08-29T21:46:26Z

Thanks for asking me to work on this. I will get started on it and keep this PR's description up to date as I form a plan and make progress.

This section details on the original issue you should resolve

<issue_title>[deep-report] JSON Schema missing organization-custom-org-roles / organization-custom-repository-roles permission fields</issue_title>
<issue_description>### Problem

organization-custom-org-roles and organization-custom-repository-roles are supported permission fields in the Go types and documented, but they are missing from the JSON Schema, so workflows using them would not get schema-validated (or would be flagged as invalid by external tooling/editors that validate against the schema).

Evidence

pkg/workflow/frontmatter_types.go:86,88 (GitHubAppPermissionsConfig) defines both fields.

Documented at docs/src/content/docs/reference/frontmatter.md:186.

Missing from $defs.github_actions_permissions.properties in the JSON Schema.

Source: Schema Consistency discussion github/gh-aw#56834, finding 3.

Suggested action

Add organization-custom-org-roles and organization-custom-repository-roles to $defs.github_actions_permissions.properties in the JSON Schema so schema-validated editors/tools recognize these already-supported fields.

Acceptance criteria

Both fields are present in the JSON Schema's github_actions_permissions definition with correct types.

A workflow frontmatter using either field validates cleanly against the schema.
[!WARNING]
Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

api.anthropic.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:
network:
  allowed:
    - defaults
    - "api.anthropic.com"
See Network Configuration for more information.
Generated by 🔬 Deep Report · claude · agent · 258.7 AIC · ⌖ 8.26 AIC · ⊞ 12.4K · ◷

expires on Aug 30, 2026, 10:49 PM UTC-08:00

Closes [deep-report] JSON Schema missing organization-custom-org-roles / organization-custom-repository-roles permission fields #56851

Comments on the Issue (you are @copilot in this section)

Fixes [deep-report] JSON Schema missing organization-custom-org-roles / organization-custom-repository-roles permission fields #56851

pelikhan · 2026-08-29T23:09:02Z

@copilot try again

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-08-29T23:17:11Z

@copilot try again

Fixed: the workflow-level permission schema now includes organization-custom-org-roles and organization-custom-repository-roles, and I added a regression check to keep them validated. go test ./pkg/workflow -run 'TestPermission' passes.

Copilot

🟡 Changes recommended

Permission error hints remain stale, and actual frontmatter validation lacks direct regression coverage.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Adds two supported organization role permissions to workflow schema validation and editor autocomplete.

Changes:

Adds both permission scopes to the shared schema.
Updates generated autocomplete metadata.
Adds schema consistency checks.

File summaries

File	Description
`pkg/parser/schemas/main_workflow_schema.json`	Defines both permission scopes.
`docs/public/editor/autocomplete-data.json`	Exposes scopes in autocomplete.
`pkg/workflow/permissions_schema_consistency_test.go`	Checks scope presence.

Review details

Files reviewed: 3/3 changed files
Comments generated: 2
Review effort level: Balanced

Copilot · 2026-08-30T01:06:57Z

+        "organization-custom-org-roles": {
+          "type": "string",
+          "enum": ["read", "write", "none"],
+          "description": "Permission level for organization custom org roles (read/write/none). Controls access to custom organization role metadata."


Added both scopes to knownFieldValidValues and knownFieldScopes for /permissions and /on/permissions in pkg/parser/schema_errors.go (commit 2eded67).

Copilot · 2026-08-30T01:06:57Z

+		if _, ok := actionsPermProps[string(scope)]; !ok {
+			t.Errorf("permission scope %q from GetAllGitHubAppOnlyScopes() is missing from "+
+				"$defs.github_actions_permissions.properties in pkg/parser/schemas/main_workflow_schema.json", scope)
+		}


Added TestOrganizationCustomRolePermissionsValidateAgainstSchema using ValidateMainWorkflowFrontmatterWithSchemaAndLocation, covering both valid values and invalid-value rejection for both scopes (commit 2eded67).

pelikhan · 2026-08-30T00:57:00Z

@copilot run pr-finisher skill

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

gh-aw-bot · 2026-08-30T02:50:50Z

@copilot PR #56982 still needs forward progress.

A maintainer already asked to run the pr-finisher skill.
Please address the outstanding Copilot review feedback: update the permission error hints and add direct regression coverage for frontmatter validation of the two new organization role permissions.
After pushing the fix, rerun the pr-finisher skill and summarize the changes on the PR.

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 15 AIC · ⌖ 8.63 AIC · ⊞ 9K · ◷
_{Comment /souschef to run again}

Copilot · 2026-08-30T02:56:04Z

@copilot PR #56982 still needs forward progress.

A maintainer already asked to run the pr-finisher skill....

The permission error hints and direct frontmatter validation regression coverage were already added and pushed in commit 2eded67 (before this comment was posted). Both changes are present on the current HEAD:

pkg/parser/schema_errors.go: knownFieldValidValues/knownFieldScopes for /permissions and /on/permissions now include both scopes.
pkg/workflow/permissions_schema_consistency_test.go: TestOrganizationCustomRolePermissionsValidateAgainstSchema validates both scopes via ValidateMainWorkflowFrontmatterWithSchemaAndLocation, including invalid-value rejection.

Re-running the pr-finisher skill now.

Initial plan

8ed4362

Copilot AI assigned Copilot and pelikhan Aug 29, 2026

Copilot started work on behalf of pelikhan August 29, 2026 21:49 View session

Copilot AI linked an issue Aug 29, 2026 that may be closed by this pull request

[deep-report] JSON Schema missing organization-custom-org-roles / organization-custom-repository-roles permission fields #56851

Closed

3 tasks

Copilot stopped work on behalf of pelikhan due to an error August 29, 2026 21:53
Failed to fetch job details: HTTP 500 Internal Server Error

Copilot AI requested a review from pelikhan August 29, 2026 21:53

Copilot started work on behalf of pelikhan August 29, 2026 23:09 View session

Add missing workflow permissions schema entries

189f462

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan August 29, 2026 23:17

pelikhan marked this pull request as ready for review August 30, 2026 00:34

Copilot AI balanced review requested due to automatic review settings August 30, 2026 00:34

Copilot started reviewing on behalf of pelikhan August 30, 2026 00:34 View session

Copilot AI reviewed Aug 30, 2026

View reviewed changes

Copilot started work on behalf of pelikhan August 30, 2026 00:57 View session

Sync permission error hints and add schema validation regression tests

2eded67

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

This was referenced Aug 30, 2026

Disable unused Codex plugin startup checks #57004

Merged

Align Copilot SDK tool catalog with compiled workflow tools #56976

Merged

Migrate MCP gateway compiler output to agentId #56990

Merged

[pr-sous-chef] PR Sous Chef run report #57003

Open

Copilot finished work on behalf of pelikhan August 30, 2026 01:07

Copilot started work on behalf of gh-aw-bot August 30, 2026 02:51 View session

Copilot finished work on behalf of gh-aw-bot August 30, 2026 02:56

Copilot AI requested a review from gh-aw-bot August 30, 2026 02:56

pelikhan merged commit 973ece4 into main Aug 30, 2026
1 check passed

pelikhan deleted the copilot/deep-report-add-custom-role-fields branch August 30, 2026 04:00

github-actions Bot mentioned this pull request Aug 30, 2026

[deep-report] Restrict organization-projects/organization-custom-org-roles permission schema to read-only #57097

Open

Navigation Menu

Uh oh!

[WIP] Add missing organization-custom-org-roles and organization-custom-repository-roles to JSON Schema - #56982

[WIP] Add missing organization-custom-org-roles and organization-custom-repository-roles to JSON Schema#56982
pelikhan merged 3 commits into
mainfrom
copilot/deep-report-add-custom-role-fields

Copilot AI commented Aug 29, 2026

Uh oh!

pelikhan commented Aug 29, 2026

Uh oh!

Copilot AI commented Aug 29, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Aug 30, 2026

Uh oh!

Copilot AI Aug 30, 2026

Uh oh!

pelikhan commented Aug 30, 2026

Uh oh!

gh-aw-bot commented Aug 30, 2026

Uh oh!

Copilot AI commented Aug 30, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

Copilot AI commented Aug 29, 2026

Evidence

Suggested action

Acceptance criteria

Comments on the Issue (you are @copilot in this section)

Uh oh!

pelikhan commented Aug 29, 2026

Uh oh!

Copilot AI commented Aug 29, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Copilot AI Aug 30, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Aug 30, 2026

Choose a reason for hiding this comment

Uh oh!

pelikhan commented Aug 30, 2026

Uh oh!

gh-aw-bot commented Aug 30, 2026

Uh oh!

Copilot AI commented Aug 30, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants