Repository navigation
Extract validatePermissions into permissions_compiler_validator.go - #29156
Conversation
Moves the validatePermissions Compiler method out of compiler_validators.go (477 → 377 lines) into a new dedicated file pkg/workflow/permissions_compiler_validator.go (136 lines) that carries a file-level doc comment covering the full validation sequence and strict-mode behaviour, satisfying the ≥30% comment-coverage requirement from AGENTS.md. No logic changes — pure mechanical extraction. Closes #<issue-number> Agent-Logs-Url: https://github.com/github/gh-aw/sessions/f51cc1cb-9c22-45e0-b434-01e8deabf662 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
validatePermissions into permissions_compiler_validator.go
There was a problem hiding this comment.
Pull request overview
This PR extracts the validatePermissions compiler validator out of compiler_validators.go into a dedicated file to bring compiler_validators.go closer to the AGENTS.md file-size guideline and to separate permission-related validation concerns.
Changes:
- Added
pkg/workflow/permissions_compiler_validator.gocontaining the extractedvalidatePermissionsmethod with expanded file-level documentation. - Removed
validatePermissionsfrompkg/workflow/compiler_validators.go, reducing that file’s length without changing validation logic.
Show a summary per file
| File | Description |
|---|---|
| pkg/workflow/permissions_compiler_validator.go | New dedicated home for permission validation logic + documentation of the validation sequence. |
| pkg/workflow/compiler_validators.go | Removes validatePermissions to reduce file length and narrow responsibilities. |
Copilot's findings
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 2/2 changed files
- Comments generated: 2
| // # Permission Validation | ||
| // | ||
| // validatePermissions orchestrates all permission-related checks in the compilation | ||
| // pipeline. It is called from validateWorkflowData (compiler_orchestrator.go) and |
There was a problem hiding this comment.
The file doc comment says validatePermissions is called from validateWorkflowData in compiler_orchestrator.go, but validateWorkflowData is currently defined in pkg/workflow/compiler.go. Please update the reference so the documentation points to the correct file.
| // pipeline. It is called from validateWorkflowData (compiler_orchestrator.go) and | |
| // pipeline. It is called from validateWorkflowData (pkg/workflow/compiler.go) and |
…lidator Generated by Design Decision Gate workflow. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
Commit pushed:
|
🏗️ Design Decision Gate — ADR RequiredThis PR makes significant changes to core business logic (139 new lines in AI has analyzed the PR diff and generated a draft ADR to help you get started: 📄 Draft ADR: What to do next
Once an ADR is linked in the PR body, this gate will re-run and verify the implementation matches the decision. Why ADRs Matter
ADRs create a searchable, permanent record of why the codebase looks the way it does. Future contributors (and your future self) will thank you. 📋 Michael Nygard ADR Format ReferenceAn ADR must contain these four sections to be considered complete:
All ADRs are stored in
References: §25120532407
|
Comment MemoryNote This comment is managed by comment memory.It stores persistent context for this thread in the code block at the top of this comment. |
compiler_validators.gowas 477 lines — 59% over the 300-line hard limit in AGENTS.md — mixing multiple validation concerns in a single file.Changes
New file
pkg/workflow/permissions_compiler_validator.go(136 lines): contains only thevalidatePermissionscompiler method with a file-level doc comment covering the full 7-step validation sequence (dangerous permissions → GitHub App constraints → MCP app write restrictions → unsupported context warnings →workflow_runbranch security → MCP toolset alignment → id-token write warning) and strict-mode behaviour. Comment coverage exceeds the AGENTS.md 30% minimum.compiler_validators.go:validatePermissionsremoved; file reduced from 477 → 377 lines. All imports remain in use by the remaining methods.Pure mechanical extraction — no logic changes.
Warning
Firewall rules blocked me from connecting to one or more addresses (expand for details)
I tried to connect to the following addresses, but was blocked by firewall rules:
https://api.github.com/graphql/usr/bin/gh gh repo view --json owner,name --jq .owner.login + "/" + .name x_amd64/link nore w(http block)/usr/bin/gh gh repo view owner/repo -o _.a -trimpath cal/bin/node -p til -lang=go1.17 /opt/hostedtoolcremote.origin.url k/gh�� Hog50vu1c /tmp/go-build1473654369/b099/vet.cfg ache/uv/0.11.8/x86_64/sh -c=4 -nolocalimports erignore rtcfg(http block)/usr/bin/gh gh repo view owner/repo -uns�� til.test /tmp/go-build1473654369/b017/vet.cfg rtcfg.link(http block)https://api.github.com/orgs/test-owner/actions/secrets/usr/bin/gh gh api /orgs/test-owner/actions/secrets --jq .secrets[].name(http block)https://api.github.com/repos/actions/ai-inference/git/ref/tags/v1/usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq [.object.sha, .object.type] | @tsv --show-toplevel 64/pkg/tool/linux_amd64/vet /usr/bin/git plorer.md(http block)https://api.github.com/repos/actions/checkout/git/ref/tags/v3/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq [.object.sha, .object.type] | @tsv --show-toplevel 64/pkg/tool/linu-goversion /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/compile json' --ignore-pgit .cfg 64/pkg/tool/linu--show-toplevel /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/compile -o /tmp/go-build282619819/b464/_pkg_.a -trimpath /usr/bin/git -p github.com/githurev-parse -lang=go1.25 git(http block)https://api.github.com/repos/actions/checkout/git/ref/tags/v5/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq [.object.sha, .object.type] | @tsv 5910-14058/test---workflow -buildtags ache/go/1.25.8/x--limit -errorsas -ifaceassert -nilfunc Bh/hKJC44cVKMHVnpBvTgXO/G1KutSxXHjoE8hqd2SJr -w 5910-14058/test-2034593501 security /home/REDACTED/work/gh-aw/gh-aw/actions/setup/js/node_modules/.bin-nilfunc -nxv(http block)/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq [.object.sha, .object.type] | @tsv --show-toplevel Q9JjIZREDlYiHWP_71/KDaUrle63TPPPTest User /usr/bin/git -unreachable=faltr /tmp/go-build147\n _.a git rev-�� --show-toplevel ache/go/1.25.8/xconfig /usr/bin/git st-3974903763 -buildtags 64/pkg/tool/linu--show-toplevel git(http block)/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq [.object.sha, .object.type] | @tsv --show-toplevel git /usr/bin/git ons-test36399358git config /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git s/test.md rev-parse /usr/bin/infocmp--show-toplevel git(http block)https://api.github.com/repos/actions/checkout/git/ref/tags/v6/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv scripts/**/*.js --ignore-path /opt/hostedtoolcache/node/24.14.1/x64/lib/node_modules/npm/node_modules/@npmcli/run-script/lib/n--show-toplevel --log-level=errogit(http block)/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv -bool -buildtags /usr/bin/git -errorsas -ifaceassert -nilfunc git rev-�� --show-toplevel -tests /usr/bin/git ath ../../../.prgit(http block)/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv --objects --stdin /usr/bin/git --exclude-hiddengit --all --quiet git rev-�� --show-toplevel x_amd64/vet clusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle js/**/*.json' --git 90 64/pkg/tool/linu--show-toplevel git(http block)https://api.github.com/repos/actions/github-script/git/ref/tags/v8/usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq [.object.sha, .object.type] | @tsv --show-toplevel sh /usr/bin/infocmp FieldEnforcementgit -tests /home/REDACTED/.np--oneline infocmp -1 xterm-color node(http block)https://api.github.com/repos/actions/github-script/git/ref/tags/v9/usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq [.object.sha, .object.type] | @tsv(http block)/usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq [.object.sha, .object.type] | @tsv -c=4 -nolocalimports -importcfg /tmp/go-build282619819/b397/importcfg -pack /home/REDACTED/work/gh-aw/gh-aw/pkg/actionpins/spec_test.go x_amd64/vet(http block)/usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq [.object.sha, .object.type] | @tsv -c=4 -nolocalimports -importcfg /tmp/go-build282619819/b406/importcfg -embedcfg /tmp/go-build282619819/b406/embedcfg aRiefE3LJ-80 er(http block)https://api.github.com/repos/actions/setup-go/git/ref/tags/v4/usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv --show-toplevel ache/go/1.25.8/x--jq /usr/bin/git --noprofile(http block)https://api.github.com/repos/actions/setup-node/git/ref/tags/v4/usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv UQnE/yW4RvIOENlQyCmptUQnE rev-parse ache/node/24.14.1/x64/bin/node js/**/*.json' --git r 64/pkg/tool/linu--show-toplevel 619819/b458/importcfg t-25�� k/gh-aw/gh-aw/.github/workflows/architecture-guardian.md 64/pkg/tool/linu-tests /opt/hostedtoolcache/node/24.14.1/x64/bin/node get --local node node(http block)/usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv --git-dir ache/go/1.25.8/xshow /usr/bin/git se 3654369/b182/vetrev-parse n-dir/node /usr/bin/git remo�� -v ache/go/1.25.8/xorigin /tmp/go-build282619819/b472/scripts.test ithout_min-integgit(http block)https://api.github.com/repos/actions/setup-node/git/ref/tags/v6/usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv '/tmp/TestParseDefaultBranchFromLsRemoteWithReal-errorsas '/tmp/TestParseDefaultBranchFromLsRemoteWithReal-ifaceassert 1/x64/bin/node .prettierignore --log-level=errorev-parse(http block)/usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv -bool -buildtags x_amd64/link -errorsas -ifaceassert -nilfunc x_amd64/link rev-�� --show-toplevel -tests /usr/bin/git .github/workflowgit(http block)/usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv 619819/b452/testutil.test --auto ache/node/24.14.1/x64/bin/node --detach -nolocalimports -importcfg m2xpu7MOJIw7R/iLX4908EimRzvG1AHIFr/vLW-tx2f42dcm-MlvCPy/t6M8s7Cmupstream t-27�� k/gh-aw/gh-aw/.github/workflows/agent-persona-explorer.md -pack 619819/b452/_pkg_.a js/**/*.json' --git r 64/pkg/tool/linu--show-toplevel git(http block)https://api.github.com/repos/actions/upload-artifact/git/ref/tags/v4/usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv /ref/tags/v9 rev-parse sv m0s yphen2866299144/rev-parse(http block)https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v0.1.2/usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v0.1.2 --jq [.object.sha, .object.type] | @tsv --show-toplevel ache/go/1.25.8/x-trimpath /usr/bin/gh .js' --ignore-pagit(http block)https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.0.0/usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.0.0 --jq [.object.sha, .object.type] | @tsv k/gh-aw/gh-aw/pkg/cli config /usr/bin/git l(http block)https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.2.3/usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.2.3 --jq [.object.sha, .object.type] | @tsv --show-toplevel l /usr/bin/git w/js/**/*.json' git(http block)https://api.github.com/repos/github/gh-aw/actions/runs/usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --limit 100 --created >=2026-04-22(http block)/usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --limit 100 --created >=2026-03-30(http block)/usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --limit 100 --created >=2026-01-29 gh/go-spew/spew(http block)https://api.github.com/repos/github/gh-aw/actions/runs/1/artifacts/usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/1/artifacts --jq .artifacts[].name(http block)/usr/bin/gh gh run download 1 --dir test-logs/run-1(http block)https://api.github.com/repos/github/gh-aw/actions/runs/12345/artifacts/usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12345/artifacts --jq .artifacts[].name origin w.test(http block)/usr/bin/gh gh run download 12345 --dir test-logs/run-12345 ne_constants.go 64/pkg/tool/linux_amd64/compile(http block)https://api.github.com/repos/github/gh-aw/actions/runs/12346/artifacts/usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12346/artifacts --jq .artifacts[].name origin 64/pkg/tool/linu-nolocalimports(http block)/usr/bin/gh gh run download 12346 --dir test-logs/run-12346 l_test.go 64/pkg/tool/linux_amd64/compile(http block)https://api.github.com/repos/github/gh-aw/actions/runs/2/artifacts/usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/2/artifacts --jq .artifacts[].name(http block)/usr/bin/gh gh run download 2 --dir test-logs/run-2(http block)https://api.github.com/repos/github/gh-aw/actions/runs/3/artifacts/usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/3/artifacts --jq .artifacts[].name nsistency_test.go 64/pkg/tool/linux_amd64/compile(http block)/usr/bin/gh gh run download 3 --dir test-logs/run-3(http block)https://api.github.com/repos/github/gh-aw/actions/runs/4/artifacts/usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/4/artifacts --jq .artifacts[].name(http block)/usr/bin/gh gh run download 4 --dir test-logs/run-4(http block)https://api.github.com/repos/github/gh-aw/actions/runs/5/artifacts/usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/5/artifacts --jq .artifacts[].name .go 64/pkg/tool/linux_amd64/vet(http block)/usr/bin/gh gh run download 5 --dir test-logs/run-5(http block)https://api.github.com/repos/github/gh-aw/actions/workflows/usr/bin/gh gh workflow list --json name,state,path(http block)/usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 100 /tmp/go-build282619819/b431/importcfg -pack /tmp/go-build282619819/b431/_testmain.go conf�� on' --ignore-pat-c=4 .cfg 64/pkg/tool/linu-importcfg user.email(http block)/usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 6(http block)https://api.github.com/repos/github/gh-aw/contents/.github/workflows/shared/reporting.md/tmp/go-build282619819/b404/cli.test /tmp/go-build282619819/b404/cli.test -test.testlogfile=/tmp/go-build282619819/b404/testlog.txt -test.paniconexit0 -test.v=true -test.parallel=4 -test.timeout=10m0s -test.run=^Test -test.short=true ssions_toolset_dsh ssions_validatio-c ssions_validator"prettier" --write 'scripts/**/*.js' --ignore-path .prettierignore --log-level=e!../../../pkg/workflow/js/**/*.json x_amd64/vet ssio�� ler.go ler_action_mode_test.go x_amd64/vet ame(http block)https://api.github.com/repos/github/gh-aw/git/ref/tags/v0.47.4/usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v0.47.4 --jq [.object.sha, .object.type] | @tsv --show-toplevel /opt/hostedtoolcache/go/1.25.8/xremote.origin.url /usr/bin/git -bool -buildtags tartedAt,updated--show-toplevel git rev-�� --show-toplevel node /usr/bin/git runs/20260429-15du --write /home/REDACTED/.lo/tmp/gh-aw/aw-feature-branch.patch git(http block)https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.0.0/usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq [.object.sha, .object.type] | @tsv or.md /tmp/go-build1473654369/b037/vet.cfg ache/node/24.14.1/x64/bin/node(http block)https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.2.3/usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq [.object.sha, .object.type] | @tsv get .cfg 64/pkg/tool/linux_amd64/vet http.https://gitgh(http block)https://api.github.com/repos/github/gh-aw/git/ref/tags/v2.0.0/usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq [.object.sha, .object.type] | @tsv get .cfg 64/pkg/tool/linux_amd64/vet http.https://git/usr/bin/git(http block)/usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq [.object.sha, .object.type] | @tsv --get-regexp go 64/pkg/tool/linux_amd64/vet(http block)/usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq [.object.sha, .object.type] | @tsv --local .cfg 64/pkg/tool/linux_amd64/vet(http block)https://api.github.com/repos/github/gh-aw/git/ref/tags/v3.0.0/usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq [.object.sha, .object.type] | @tsv --get-regexp .cfg 64/pkg/tool/linux_amd64/vet(http block)https://api.github.com/repos/nonexistent/action/git/ref/tags/v999.999.999/usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq [.object.sha, .object.type] | @tsv -unreachable=false /tmp/go-build1473654369/b062/vet.cfg x_amd64/vet(http block)https://api.github.com/repos/nonexistent/repo/actions/runs/12345/usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion(http block)https://api.github.com/repos/owner/repo/actions/workflows/usr/bin/gh gh workflow list --json name,state,path --repo owner/repo x_amd64/vet(http block)/usr/bin/gh gh workflow list --repo owner/repo --json name,path,state e_modules/.bin/node(http block)https://api.github.com/repos/test-owner/test-repo/actions/secrets/usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name(http block)https://api.github.com/repos/test/repo/usr/bin/gh gh api /repos/test/repo --jq .default_branch rite '**/*.cjs' '**/*.ts' '**/*.json' --ignore-path ../../../.pr**/*.json /tmp/go-build1473654369/b142/vet.cfg sh -main/dist/indexgit(http block)If you need me to access, download, or install something from one of these locations, you can either: