fix: add pull-requests:write to safe_outputs job for add-comment#18318
Merged
fix: add pull-requests:write to safe_outputs job for add-comment#18318
Conversation
This was referenced Feb 25, 2026
…configured - Add Issues and PullRequests fields to AddCommentsConfig struct - Default: issues=true (issues:write), pull-requests=true (pull-requests:write), discussions=false (no discussions:write) - Update buildCreateOutputAddCommentJob to use dynamic permissions and conditions - Add buildAddCommentPermissions helper shared by job builder and permissions calculator - Update ComputePermissionsForSafeOutputs to use the new helper - Update JSON schema with issues and pull-requests boolean properties - Update tests to reflect new default behavior - Recompile all workflow lock files Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Copilot
AI
changed the title
[WIP] Fix safe_outputs job permissions for pull-requests
fix: add pull-requests:write to safe_outputs job for add-comment
Feb 25, 2026
Contributor
|
@copilot enable discussion: true by default |
Change discussions default from false back to true (nil = true). Now all three target types default to true: - issues: nil or true → issues:write - pull-requests: nil or true → pull-requests:write - discussions: nil or true → discussions:write Set any field to false to opt out of that permission/event condition. Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
Author
Done in 38ab344. Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
Contributor
There was a problem hiding this comment.
Pull request overview
This pull request fixes a bug where the compiler only emitted issues: write permission for safe_outputs jobs with add-comment configured, causing "Resource not accessible by integration" errors when posting comments on pull requests.
Changes:
- Added configurable
issues,pull-requests, anddiscussionsfields to theadd-commentconfiguration (all default totrue) - Created shared
buildAddCommentPermissions()helper function used by both the dedicated job builder andComputePermissionsForSafeOutputs - Implemented dynamic event condition building that reflects which target types are enabled
Reviewed changes
Copilot reviewed 21 out of 21 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| pkg/workflow/add_comment.go | Added new configurable fields (Issues, PullRequests, Discussions), created buildAddCommentPermissions() helper, and updated event condition building logic to be dynamic based on enabled target types |
| pkg/workflow/safe_outputs_permissions.go | Refactored to use the new shared buildAddCommentPermissions() helper instead of inline permission logic |
| pkg/workflow/safe_outputs_permissions_test.go | Added comprehensive test coverage for all permission combinations (default, discussions:true/false, pull-requests:false, issues:false) |
| pkg/parser/schemas/main_workflow_schema.json | Added schema definitions for the three new boolean fields with proper descriptions |
| .github/workflows/*.lock.yml | All 158 workflow lock files recompiled to include pull-requests: write permission in safe_outputs jobs |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Contributor
Smoke Test: Gemini Engine Validation
Overall Status: FAIL
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
add-commentcan target both issues and pull requests, but the compiler only emittedissues: write— causing "Resource not accessible by integration" when posting comments on PRs.Changes
issuesandpull-requestsfields onadd-comment— control permission emission and event condition targeting. Both default totrue.discussionsremainstrueby default — setdiscussions: falseto opt out if your GitHub App lacks Discussions permission.github.event.issue.number || github.event.pull_request.number || github.event.discussion.number).buildAddCommentPermissions()helper — used by both the dedicated add_comment job builder andComputePermissionsForSafeOutputs.Generated
safe_outputspermissions now includepull-requests: writeby default:All 158 workflow lock files recompiled — updated to include
pull-requests: writealongsideissues: writeanddiscussions: write.Original prompt
🔒 GitHub Advanced Security automatically protects Copilot coding agent pull requests. You can protect all pull requests by enabling Advanced Security for your repositories. Learn more about Advanced Security.