Skip to content

Revert "feat: send additional_permissions in token exchange request" #864

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ashwin-ant merged 1 commit into from
Jan 27, 2026
Merged

Revert "feat: send additional_permissions in token exchange request" #864

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 2 additions & 7 deletions docs/configuration.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -172,14 +172,9 @@ jobs:

**Important Notes**:

- The GitHub token must have the corresponding permission in your workflow
- The GitHub token must have the `actions: read` permission in your workflow
- If the permission is missing, Claude will warn you and suggest adding it
- The following additional permissions can be requested beyond the defaults:
- `actions: read`
- `checks: read`
- `discussions: read` or `discussions: write`
- `workflows: read` or `workflows: write`
- Standard permissions (`contents: write`, `pull_requests: write`, `issues: write`) are always included and do not need to be specified
- Currently, only `actions: read` is supported, but the format allows for future extensions
Copy link
Contributor

@claude claude bot Jan 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Incomplete revert: While this documentation was updated, the following files still reference additional_permissions:

  1. action.yml (lines 76-79, 198) - Input definition and environment variable still exist
  2. src/entrypoints/collect-inputs.ts (line 20) - Still includes additional_permissions: "" in defaults
  3. docs/usage.md (lines 47-48, 73) - Still documents the input parameter in examples and reference table
  4. docs/faq.md (lines 100-101) - Still shows example usage

This creates a confusing UX where users can provide the additional_permissions input (it's still accepted), but it's silently ignored since the backend processing was removed.

Recommendation: Either:

  • Complete the revert by removing these references, OR
  • Document in the PR description that keeping the interface is intentional for a future re-implementation


## Custom Environment Variables

Expand Down
63 changes: 8 additions & 55 deletions src/github/token.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,60 +16,15 @@ async function getOidcToken(): Promise<string> {
}
}

const DEFAULT_PERMISSIONS: Record<string, string> = {
contents: "write",
pull_requests: "write",
issues: "write",
};

export function parseAdditionalPermissions():
| Record<string, string>
| undefined {
const raw = process.env.ADDITIONAL_PERMISSIONS;
if (!raw || !raw.trim()) {
return undefined;
}

const additional: Record<string, string> = {};
for (const line of raw.split("\n")) {
const trimmed = line.trim();
if (!trimmed) continue;
const colonIndex = trimmed.indexOf(":");
if (colonIndex === -1) continue;
const key = trimmed.slice(0, colonIndex).trim();
const value = trimmed.slice(colonIndex + 1).trim();
if (key && value) {
additional[key] = value;
}
}

if (Object.keys(additional).length === 0) {
return undefined;
}

return { ...DEFAULT_PERMISSIONS, ...additional };
}

async function exchangeForAppToken(
oidcToken: string,
permissions?: Record<string, string>,
): Promise<string> {
const headers: Record<string, string> = {
Authorization: `Bearer ${oidcToken}`,
};
const fetchOptions: RequestInit = {
method: "POST",
headers,
};

if (permissions) {
headers["Content-Type"] = "application/json";
fetchOptions.body = JSON.stringify({ permissions });
}

async function exchangeForAppToken(oidcToken: string): Promise<string> {
const response = await fetch(
"https://api.anthropic.com/api/github/github-app-token-exchange",
fetchOptions,
{
method: "POST",
headers: {
Authorization: `Bearer ${oidcToken}`,
},
},
);

if (!response.ok) {
Expand Down Expand Up @@ -134,11 +89,9 @@ export async function setupGitHubToken(): Promise<string> {
const oidcToken = await retryWithBackoff(() => getOidcToken());
console.log("OIDC token successfully obtained");

const permissions = parseAdditionalPermissions();

console.log("Exchanging OIDC token for app token...");
const appToken = await retryWithBackoff(() =>
exchangeForAppToken(oidcToken, permissions),
exchangeForAppToken(oidcToken),
);
console.log("App token successfully obtained");

Expand Down
97 changes: 0 additions & 97 deletions test/parse-permissions.test.ts
View file
Open in desktop

This file was deleted.

Loading