[WIP] Recompile and fix Agentic workflows permissions #2789
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Copilot stopped work on behalf of
pelikhan due to an error
October 30, 2025 13:09
…orkflows-permissions
- Modified permissions across multiple workflows to include 'issues' and 'pull-requests' while removing 'actions' where applicable. - Changed the runtime environment from 'ubuntu-latest' to 'ubuntu-slim' for improved efficiency in various workflows. - Ensured consistency in permission settings for workflows related to issue classification, logging, and analysis. - Enhanced security and functionality by adding necessary permissions for discussions and security events in relevant workflows.
There was a problem hiding this comment.
Pull Request Overview
This PR fixes permission issues in agentic workflows that use safe-outputs and recompiles all workflows to generate updated lock files. The main issue was that workflows using the safe-outputs system were incorrectly including write permissions in their frontmatter, when those permissions should be removed since safe-outputs handles write operations in separate jobs.
- Corrected permissions in
schema-consistency-checker.mdby removingdiscussions: writeandread-only: false - Updated all workflow permissions to replace
actions: readwith specific permissions likeissues: readandpull-requests: read - Recompiled all workflows to reflect the permission changes and infrastructure updates
Reviewed Changes
Copilot reviewed 62 out of 62 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
pkg/workflow/schemas/github-workflow.json |
Formatted enum arrays for better readability |
schema-consistency-checker.md |
Fixed safe-outputs permissions issue by removing write permissions |
Various .md workflow files |
Updated permissions from actions: read to specific read permissions |
Various .lock.yml files |
Recompiled workflows with updated permissions and infrastructure changes |
.github/aw/actions-lock.json |
Added new GitHub Script action version |
Comments suppressed due to low confidence (1)
.github/workflows/schema-consistency-checker.md:1
- The
read-only: falseconfiguration was correctly removed as it conflicts with safe-outputs usage. When usingsafe-outputs: create-discussion, the main job should not have write permissions since safe-outputs handles write operations in a separate job.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Recompile and Fix Agentic Workflows Permissions
Summary
Fix permission issues in agentic workflows that use safe-outputs, then recompile all workflows to generate updated lock files.
Checklist
Issue Found
The
schema-consistency-checker.mdworkflow has:discussions: writepermission in frontmatter (line 9)read-only: falsefor GitHub tools (line 16)Both should be removed when using
safe-outputs: create-discussionsince the safe-outputs system handles write operations in a separate job with appropriate permissions.Original prompt
💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.