fix: validation-issue-read-v1471 (#759)

Author: 0xPlayerOne

.github/workflows/ci.yml

@@ -183,6 +183,9 @@ jobs:
   type-check:
     name: Type-Check
     if: vars.CI_BILLING_PAUSED != 'true'
+    permissions:
+      contents: read
+      issues: read
     runs-on: ${{ inputs.runner }}
     timeout-minutes: 30
     steps:
@@ -226,6 +229,8 @@ jobs:
       - name: Type-Check
         id: execute
         if: steps.applicability.outputs.applicable == 'true' && steps.applicability.outputs.affected != 'false'
+        env:
+          GH_TOKEN: ${{ github.token }}
         run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci type_check
       - name: Retain task receipt
         if: >-

.github/workflows/validation-billing.yml

@@ -533,6 +533,9 @@ jobs:
   type-check:
     name: Type-Check
     if: vars.CI_BILLING_PAUSED != 'true'
+    permissions:
+      contents: read
+      issues: read
     runs-on: ${{ inputs.ci-runner }}
     timeout-minutes: 30
     steps:
@@ -576,6 +579,8 @@ jobs:
       - name: Type-Check
         id: execute
         if: steps.applicability.outputs.applicable == 'true' && steps.applicability.outputs.affected != 'false'
+        env:
+          GH_TOKEN: ${{ github.token }}
         run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci type_check
       - name: Retain task receipt
         if: >-

.github/workflows/validation-no-codeql.yml

@@ -104,6 +104,12 @@ jobs:
   ci:
     name: CI
     if: vars.CI_BILLING_PAUSED != 'true' && (inputs.mode == 'fast' || inputs.mode == 'audit' || inputs.mode == 'release')
+    # Forward issue-read only to the CI workflow that runs Type-Check.
+    permissions:
+      actions: read
+      contents: read
+      issues: read
+      packages: read
     uses: ./.github/workflows/ci.yml
     with:
       runtime-repository: ${{ inputs.runtime-repository }}

.github/workflows/validation.yml

@@ -104,6 +104,12 @@ jobs:
   ci:
     name: CI
     if: vars.CI_BILLING_PAUSED != 'true' && (inputs.mode == 'fast' || inputs.mode == 'audit' || inputs.mode == 'release')
+    # Type-Check reads the issue-backed requirements ledger with github.token.
+    permissions:
+      actions: read
+      contents: read
+      issues: read
+      packages: read
     uses: ./.github/workflows/ci.yml
     with:
       runtime-repository: ${{ inputs.runtime-repository }}

.github/workflows/validation_audit_self-ci.yml

@@ -22,6 +22,7 @@ jobs:
     permissions:
       actions: read
       contents: read
+      issues: read
       packages: read
       security-events: write
     uses: 0xPlayerOne/code-foundry/.github/workflows/validation.yml@main

.github/workflows/validation_self-ci.yml

@@ -78,6 +78,7 @@ jobs:
     permissions:
       actions: read
       contents: read
+      issues: read
       packages: read
       security-events: write
     uses: ./.github/workflows/validation.yml

src/lib/consumer-qualification.mjs

@@ -166,12 +166,7 @@ function lintContracts(consumer, candidate, destination, actionlint, version) {
   // keywords (adea's desktop-shell, for one) stay covered without list
   // maintenance. Restore the removal of this exclusion when
   // rhysd/actionlint releases post-parallel support.
-  const pendingParallelSyntax = /(?:^|\n)\s*(?:background|wait|wait-all|cancel|parallel):/m
-  const workflows = readdirSync(join(destination, '.github/workflows')).filter((name) => {
-    if (!/\.ya?ml$/.test(name)) return false
-    const text = readFileSync(join(destination, '.github/workflows', name), 'utf8')
-    return !pendingParallelSyntax.test(text)
-  })
+  const workflows = actionlintEligibleWorkflows(join(destination, '.github/workflows'))
   run(
     actionlint,
     [
@@ -184,6 +179,15 @@ function lintContracts(consumer, candidate, destination, actionlint, version) {
   return paths.length
 }
 
+/** @param {string} workflowsDirectory */
+export function actionlintEligibleWorkflows(workflowsDirectory) {
+  const pendingParallelSyntax = /^[ \t]*(?:-[ \t]+)?(?:background|wait|wait-all|cancel|parallel):/m
+  return readdirSync(workflowsDirectory).filter((name) => {
+    if (!/\.ya?ml$/.test(name)) return false
+    return !pendingParallelSyntax.test(readFileSync(join(workflowsDirectory, name), 'utf8'))
+  })
+}
+
 /** @param {{ packageFile: string, sourceSha: string, reportPath: string, actionlint?: string }} options */
 export function qualifyCandidate(options) {
   if (!/^[a-f0-9]{40}$/.test(options.sourceSha))

src/lib/merge-queue.mjs

@@ -110,6 +110,7 @@ on:
 permissions:
   actions: read
   contents: read
+  issues: read
   packages: read
   security-events: write
 

src/templates/workflows/validation-audit.yml

@@ -22,6 +22,7 @@ jobs:
     permissions:
       actions: read
       contents: read
+      issues: read
       packages: read
       security-events: write
     uses: ./.github/workflows/validation.yml

test/consumer-qualification.test.mjs

@@ -1,9 +1,10 @@
 import assert from 'node:assert/strict'
 import test from 'node:test'
-import { mkdtempSync, readFileSync, writeFileSync, rmSync, symlinkSync } from 'node:fs'
+import { mkdirSync, mkdtempSync, writeFileSync, rmSync, symlinkSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import {
+  actionlintEligibleWorkflows,
   digest,
   FIXTURES,
   localizeCalls,
@@ -67,19 +68,32 @@ test('candidate source identity is mandatory before any install', () => {
   )
 })
 
-test('the actionlint pass excludes pending parallel syntax by content, not by filename', () => {
-  // actionlint v1.7.12 predates the step-parallelism keywords; the
-  // qualification skips any workflow whose text uses them so
-  // repository-owned adopters (adea's desktop-shell) stay covered without
-  // list maintenance.
-  const source = readFileSync(join(process.cwd(), 'src/lib/consumer-qualification.mjs'), 'utf8')
-  const line = source
-    .split('\n')
-    .find((candidate) => candidate.includes('const pendingParallelSyntax ='))
-  assert.ok(line, 'the qualification declares the pending-syntax pattern')
-  for (const keyword of ['background', 'wait', 'wait-all', 'cancel', 'parallel']) {
-    assert.ok(line.includes(keyword), `the pattern covers ${keyword}`)
+test('the actionlint pass filters pending parallel syntax by content, not filename', (t) => {
+  const workflows = join(temporary(t), '.github', 'workflows')
+  mkdirSync(workflows, { recursive: true })
+  const keywords = ['background', 'wait', 'wait-all', 'cancel', 'parallel']
+  for (const keyword of keywords) {
+    writeFileSync(
+      join(workflows, `pending-sequence-${keyword}.yml`),
+      `jobs:\n  check:\n    steps:\n      - ${keyword}:\n          run: echo pending\n`
+    )
+    writeFileSync(
+      join(workflows, `pending-mapping-${keyword}.yaml`),
+      `workflow:\n  ${keyword}:\n    enabled: true\n`
+    )
   }
-  assert.ok(!source.includes("new Set(['validation-billing.yml'])"), 'the filename list is gone')
-  assert.match(source, /pendingParallelSyntax\.test\(text\)/, 'files are filtered by content')
+  writeFileSync(
+    join(workflows, 'validation-billing.yml'),
+    'jobs:\n  check:\n    steps:\n      - run: echo parallel\n'
+  )
+  writeFileSync(
+    join(workflows, 'validation.yml'),
+    'jobs:\n  check:\n    steps:\n      - run: echo ok\n'
+  )
+  writeFileSync(join(workflows, 'README.md'), 'parallel:\n')
+
+  assert.deepEqual(actionlintEligibleWorkflows(workflows).toSorted(), [
+    'validation-billing.yml',
+    'validation.yml',
+  ])
 })