Skip to content

develop: add PAT permission guidance and verification #400

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
efraespada merged 53 commits into from
Sep 24, 2026
Merged

develop: add PAT permission guidance and verification #400

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
53 commits
Select commit Hold shift + click to select a range
61db6ea
develop: add PAT permission guidance and verification
efraespada Sep 20, 2026
185e2cd
Merge remote-tracking branch 'origin/master' into develop
efraespada Sep 20, 2026
be48110
develop: close PAT permission coverage gaps
efraespada Sep 20, 2026
b0977e7
develop: bound unavailable setup inventory reads
efraespada Sep 20, 2026
a8ac8f6
develop: fail closed on unavailable setup inventory
efraespada Sep 20, 2026
021c842
develop: scope setup inventory validation
efraespada Sep 20, 2026
952b0d8
develop: classify setup permission failures safely
efraespada Sep 20, 2026
31e0bc7
develop: keep generic forbidden permission probes unverifiable
efraespada Sep 20, 2026
ff1178b
develop: scope generic forbidden probe handling
efraespada Sep 20, 2026
c06d8ab
develop: cover ambiguous permission response failures
efraespada Sep 20, 2026
726b2c4
develop: review full diffs in bounded partitions
efraespada Sep 20, 2026
56094d6
develop: close exhaustive Bugbot review findings
efraespada Sep 20, 2026
68a5e61
develop: close exhaustive Bugbot edge cases
efraespada Sep 20, 2026
f6c5640
develop: tighten Bugbot boundaries and setup grants
efraespada Sep 20, 2026
e5f19d0
develop: close remaining exhaustive review findings
efraespada Sep 20, 2026
e777841
develop: align setup permissions and blocked handling
efraespada Sep 21, 2026
be42e7a
develop: harden setup permission audits
efraespada Sep 21, 2026
76ad1f1
develop: cover bound member authorization
efraespada Sep 21, 2026
a5963de
develop: resolve setup audit findings
efraespada Sep 21, 2026
8c30093
develop: resolve checks permission probe ref
efraespada Sep 21, 2026
611dd58
develop: align partition test budgets
efraespada Sep 21, 2026
bba60e6
develop: harden Bugbot review trust boundaries
efraespada Sep 21, 2026
9427433
develop: close remaining Bugbot findings
efraespada Sep 21, 2026
a6b2021
develop: enforce safe setup automation examples
efraespada Sep 21, 2026
49ab840
develop: close exhaustive Bugbot review findings
efraespada Sep 21, 2026
b17eac7
develop: fail closed on setup inventory and bound Bugbot raw diffs
efraespada Sep 21, 2026
898a210
develop: reconcile public PAT reads and fail closed on setup inspection
efraespada Sep 21, 2026
10874b8
develop: scope workflow PAT grants to enabled capabilities
efraespada Sep 21, 2026
423734f
develop: assign unavailable patches and correct PAT guidance
efraespada Sep 21, 2026
714fac4
develop: distinguish PAT Contents probe from workflow visibility
efraespada Sep 21, 2026
1fedfb0
develop: cover standalone members-only actions and harden PAT guidance
efraespada Sep 21, 2026
65ce9be
develop: block denied audits and inspect credential health on selecte…
efraespada Sep 21, 2026
5e4751f
develop: make example PAT grants conditional
efraespada Sep 21, 2026
7786491
develop: reject malformed workflow Contents evidence
efraespada Sep 21, 2026
24f3490
develop: validate exhaustive review and workflow visibility inputs
efraespada Sep 21, 2026
edec58a
develop: preserve verbatim Bugbot fragments and gate active tasks
efraespada Sep 21, 2026
2f5644f
develop: close exhaustive review validation gaps
efraespada Sep 23, 2026
fd095f2
develop: close review identity and admission findings
efraespada Sep 23, 2026
4c7edc3
develop: validate Bugbot review head identities
efraespada Sep 23, 2026
b859c44
develop: close remaining review findings
efraespada Sep 23, 2026
593b549
develop: clarify member-only planner authorization
efraespada Sep 23, 2026
2cced48
develop: close PR review findings for setup permissions and health
efraespada Sep 24, 2026
794e05a
develop: guard setup bootstrap cleanup and inventory preflight
efraespada Sep 24, 2026
0ee8e03
develop: retry transient partition analysis failures
efraespada Sep 24, 2026
9ec820a
develop: validate README PAT examples and default Codex to GPT-6 Luna
efraespada Sep 24, 2026
dc33c34
develop: pin Luna-compatible Codex CLI runtime
efraespada Sep 24, 2026
a5c1aba
develop: make required PAT write acknowledgement explicit
efraespada Sep 24, 2026
6fa92ef
develop: validate public PAT evidence and organization shadows
efraespada Sep 24, 2026
45798c7
develop: verify organization Members with protected membership probe
efraespada Sep 24, 2026
fb9a447
develop: bind Bugbot partition output schema to trusted assignment
efraespada Sep 24, 2026
e16e3db
develop: reconcile Bugbot review blocks in bounded batches
efraespada Sep 24, 2026
cca631a
develop: align agent runtime SDD test budget
efraespada Sep 24, 2026
7261967
develop: inspect blockquoted PAT recovery examples
efraespada Sep 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/copilot_close_inactive_issues.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,7 @@ jobs:
inactivity-threshold-hours: ${{ inputs.inactivity_threshold_hours || vars.INACTIVITY_THRESHOLD_HOURS || '168' }}
agent-provider: ${{ vars.AGENT_PROVIDER || 'codex' }}
agent-model-provider: ${{ vars.AGENT_MODEL_PROVIDER || 'openai' }}
agent-model: ${{ vars.AGENT_MODEL || 'gpt-5.6-luna' }}
agent-model: ${{ vars.AGENT_MODEL || 'gpt-6-luna' }}
agent-effort: ${{ vars.AGENT_EFFORT }}
agent-executable: ${{ vars.AGENT_EXECUTABLE }}
findings-provider: ${{ vars.FINDINGS_PROVIDER }}
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/copilot_commit.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,7 +63,7 @@ jobs:
project-ids: ${{ vars.PROJECT_IDS }}
agent-provider: ${{ vars.AGENT_PROVIDER || 'codex' }}
agent-model-provider: ${{ vars.AGENT_MODEL_PROVIDER || 'openai' }}
agent-model: ${{ vars.AGENT_MODEL || 'gpt-5.6-luna' }}
agent-model: ${{ vars.AGENT_MODEL || 'gpt-6-luna' }}
agent-effort: ${{ vars.AGENT_EFFORT }}
agent-executable: ${{ vars.AGENT_EXECUTABLE }}
findings-provider: ${{ vars.FINDINGS_PROVIDER }}
Expand All @@ -84,7 +84,7 @@ jobs:
AGENT_EFFORT: ${{ vars.AGENT_EFFORT }}
AGENT_PROVISIONING: ${{ vars.AGENT_PROVISIONING || 'auto' }}
AGENT_ALLOWED_MODEL_PROVIDERS: ${{ vars.AGENT_ALLOWED_MODEL_PROVIDERS || 'openai' }}
AGENT_ALLOWED_MODELS: ${{ vars.AGENT_ALLOWED_MODELS || 'openai/gpt-5.6-luna' }}
AGENT_ALLOWED_MODELS: ${{ vars.AGENT_ALLOWED_MODELS || 'openai/gpt-6-luna' }}
AGENT_EXECUTABLE: ${{ vars.AGENT_EXECUTABLE }}
OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }}
OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/copilot_issue.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,7 +41,7 @@ jobs:
debug: ${{ vars.DEBUG }}
agent-provider: ${{ vars.AGENT_PROVIDER || 'codex' }}
agent-model-provider: ${{ vars.AGENT_MODEL_PROVIDER || 'openai' }}
agent-model: ${{ vars.AGENT_MODEL || 'gpt-5.6-luna' }}
agent-model: ${{ vars.AGENT_MODEL || 'gpt-6-luna' }}
agent-effort: ${{ vars.AGENT_EFFORT }}
agent-executable: ${{ vars.AGENT_EXECUTABLE }}
findings-provider: ${{ vars.FINDINGS_PROVIDER }}
Expand All @@ -68,7 +68,7 @@ jobs:
AGENT_EFFORT: ${{ vars.AGENT_EFFORT }}
AGENT_PROVISIONING: ${{ vars.AGENT_PROVISIONING || 'auto' }}
AGENT_ALLOWED_MODEL_PROVIDERS: ${{ vars.AGENT_ALLOWED_MODEL_PROVIDERS || 'openai' }}
AGENT_ALLOWED_MODELS: ${{ vars.AGENT_ALLOWED_MODELS || 'openai/gpt-5.6-luna' }}
AGENT_ALLOWED_MODELS: ${{ vars.AGENT_ALLOWED_MODELS || 'openai/gpt-6-luna' }}
AGENT_EXECUTABLE: ${{ vars.AGENT_EXECUTABLE }}
OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }}
OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/copilot_issue_comment.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,7 @@ jobs:
debug: ${{ vars.DEBUG }}
agent-provider: ${{ vars.AGENT_PROVIDER || 'codex' }}
agent-model-provider: ${{ vars.AGENT_MODEL_PROVIDER || 'openai' }}
agent-model: ${{ vars.AGENT_MODEL || 'gpt-5.6-luna' }}
agent-model: ${{ vars.AGENT_MODEL || 'gpt-6-luna' }}
agent-effort: ${{ vars.AGENT_EFFORT }}
agent-executable: ${{ vars.AGENT_EXECUTABLE }}
findings-provider: ${{ vars.FINDINGS_PROVIDER }}
Expand Down Expand Up @@ -80,7 +80,7 @@ jobs:
AGENT_EFFORT: ${{ vars.AGENT_EFFORT }}
AGENT_PROVISIONING: ${{ vars.AGENT_PROVISIONING || 'auto' }}
AGENT_ALLOWED_MODEL_PROVIDERS: ${{ vars.AGENT_ALLOWED_MODEL_PROVIDERS || 'openai' }}
AGENT_ALLOWED_MODELS: ${{ vars.AGENT_ALLOWED_MODELS || 'openai/gpt-5.6-luna' }}
AGENT_ALLOWED_MODELS: ${{ vars.AGENT_ALLOWED_MODELS || 'openai/gpt-6-luna' }}
AGENT_EXECUTABLE: ${{ vars.AGENT_EXECUTABLE }}
OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }}
OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/copilot_pull_request.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,7 +62,7 @@ jobs:
debug: ${{ vars.DEBUG }}
agent-provider: ${{ vars.AGENT_PROVIDER || 'codex' }}
agent-model-provider: ${{ vars.AGENT_MODEL_PROVIDER || 'openai' }}
agent-model: ${{ vars.AGENT_MODEL || 'gpt-5.6-luna' }}
agent-model: ${{ vars.AGENT_MODEL || 'gpt-6-luna' }}
agent-effort: ${{ vars.AGENT_EFFORT }}
agent-executable: ${{ vars.AGENT_EXECUTABLE }}
findings-provider: ${{ vars.FINDINGS_PROVIDER }}
Expand Down Expand Up @@ -94,7 +94,7 @@ jobs:
AGENT_EFFORT: ${{ vars.AGENT_EFFORT }}
AGENT_PROVISIONING: ${{ vars.AGENT_PROVISIONING || 'auto' }}
AGENT_ALLOWED_MODEL_PROVIDERS: ${{ vars.AGENT_ALLOWED_MODEL_PROVIDERS || 'openai' }}
AGENT_ALLOWED_MODELS: ${{ vars.AGENT_ALLOWED_MODELS || 'openai/gpt-5.6-luna' }}
AGENT_ALLOWED_MODELS: ${{ vars.AGENT_ALLOWED_MODELS || 'openai/gpt-6-luna' }}
AGENT_EXECUTABLE: ${{ vars.AGENT_EXECUTABLE }}
OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }}
OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/copilot_pull_request_comment.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,7 @@ jobs:
debug: ${{ vars.DEBUG }}
agent-provider: ${{ vars.AGENT_PROVIDER || 'codex' }}
agent-model-provider: ${{ vars.AGENT_MODEL_PROVIDER || 'openai' }}
agent-model: ${{ vars.AGENT_MODEL || 'gpt-5.6-luna' }}
agent-model: ${{ vars.AGENT_MODEL || 'gpt-6-luna' }}
agent-effort: ${{ vars.AGENT_EFFORT }}
agent-executable: ${{ vars.AGENT_EXECUTABLE }}
findings-provider: ${{ vars.FINDINGS_PROVIDER }}
Expand Down Expand Up @@ -80,7 +80,7 @@ jobs:
AGENT_EFFORT: ${{ vars.AGENT_EFFORT }}
AGENT_PROVISIONING: ${{ vars.AGENT_PROVISIONING || 'auto' }}
AGENT_ALLOWED_MODEL_PROVIDERS: ${{ vars.AGENT_ALLOWED_MODEL_PROVIDERS || 'openai' }}
AGENT_ALLOWED_MODELS: ${{ vars.AGENT_ALLOWED_MODELS || 'openai/gpt-5.6-luna' }}
AGENT_ALLOWED_MODELS: ${{ vars.AGENT_ALLOWED_MODELS || 'openai/gpt-6-luna' }}
AGENT_EXECUTABLE: ${{ vars.AGENT_EXECUTABLE }}
OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }}
OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/copilot_pull_request_review_state.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,7 +51,7 @@ jobs:
debug: ${{ vars.DEBUG }}
agent-provider: ${{ vars.AGENT_PROVIDER || 'codex' }}
agent-model-provider: ${{ vars.AGENT_MODEL_PROVIDER || 'openai' }}
agent-model: ${{ vars.AGENT_MODEL || 'gpt-5.6-luna' }}
agent-model: ${{ vars.AGENT_MODEL || 'gpt-6-luna' }}
agent-effort: ${{ vars.AGENT_EFFORT }}
agent-executable: ${{ vars.AGENT_EXECUTABLE }}
findings-provider: ${{ vars.FINDINGS_PROVIDER }}
Expand Down Expand Up @@ -83,7 +83,7 @@ jobs:
AGENT_EFFORT: ${{ vars.AGENT_EFFORT }}
AGENT_PROVISIONING: ${{ vars.AGENT_PROVISIONING || 'auto' }}
AGENT_ALLOWED_MODEL_PROVIDERS: ${{ vars.AGENT_ALLOWED_MODEL_PROVIDERS || 'openai' }}
AGENT_ALLOWED_MODELS: ${{ vars.AGENT_ALLOWED_MODELS || 'openai/gpt-5.6-luna' }}
AGENT_ALLOWED_MODELS: ${{ vars.AGENT_ALLOWED_MODELS || 'openai/gpt-6-luna' }}
AGENT_EXECUTABLE: ${{ vars.AGENT_EXECUTABLE }}
OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }}
OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
Expand Down
2 changes: 1 addition & 1 deletion action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -426,7 +426,7 @@ inputs:

agent-model:
description: "Selected model name without the provider prefix. The provider is configured separately with agent-model-provider."
default: "gpt-5.6-luna"
default: "gpt-6-luna"
agent-executable:
description: "Optional exact CLI basename or absolute executable path. Arguments, wrappers, and alternate basenames are rejected."
default: ""
Expand Down
Loading