feat: infer gh CLI permissions for activation job pre-steps#32849

Merged

pelikhan merged 16 commits into

mainfrom

copilot/fix-compiler-permissions-issue

May 17, 2026

Commits on May 17, 2026

Initial plan
Copilot
authored
feat: infer gh CLI permissions for activation job pre-steps

Copilot
and
pelikhan
authored
fix: address code review feedback on gh CLI permissions inference

Copilot
and
pelikhan
authored
feat: expand gh CLI permissions mapping and detect write commands in activation pre-steps

Copilot
and
pelikhan
authored
fix: add docs reference to write-command error message

Copilot
and
pelikhan
authored
feat: map gh CLI groups to GitHub App permissions

Copilot
and
pelikhan
authored
refactor: dynamic regex from JSON keys, cache pre-step inference in build context

Copilot
and
pelikhan
authored
fix: skip permission inference when no pre-step scripts present

Copilot
and
pelikhan
authored
fix: apply gh CLI write-detector and read-inference to agent job pre-steps

Copilot
and
pelikhan
authored
refactor: address code review - split conditions, document permissions check, fix test SHA

Copilot
and
pelikhan
authored
feat: extend gh CLI scan to all step section types (steps, post-steps, pre-agent-steps)

Copilot
and
pelikhan
authored
docs: clarify pre-agent-steps exclusion from activation job scan

Copilot
and
pelikhan
authored
docs(adr): draft ADR-32849 for gh CLI permission inference
github-actions[bot]
authored
fix: restrict gh CLI scanning to actually-injected step sections

Copilot
and
pelikhan
authored
fix: handle escape sequences in splitShellTokens and improve test coverage

Copilot
and
pelikhan
authored
Merge branch 'main' into copilot/fix-compiler-permissions-issue
github-actions[bot]
authored

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: infer gh CLI permissions for activation job pre-steps#32849

feat: infer gh CLI permissions for activation job pre-steps#32849
pelikhan merged 16 commits into
mainfrom
copilot/fix-compiler-permissions-issue

Commits on May 17, 2026

Initial plan

feat: infer gh CLI permissions for activation job pre-steps

fix: address code review feedback on gh CLI permissions inference

feat: expand gh CLI permissions mapping and detect write commands in activation pre-steps

fix: add docs reference to write-command error message

feat: map gh CLI groups to GitHub App permissions

refactor: dynamic regex from JSON keys, cache pre-step inference in build context

fix: skip permission inference when no pre-step scripts present

fix: apply gh CLI write-detector and read-inference to agent job pre-steps

refactor: address code review - split conditions, document permissions check, fix test SHA

feat: extend gh CLI scan to all step section types (steps, post-steps, pre-agent-steps)

docs: clarify pre-agent-steps exclusion from activation job scan

docs(adr): draft ADR-32849 for gh CLI permission inference

fix: restrict gh CLI scanning to actually-injected step sections

fix: handle escape sequences in splitShellTokens and improve test coverage

Merge branch 'main' into copilot/fix-compiler-permissions-issue