Description
The on.roles runtime (actions/setup/js/check_permissions_utils.cjs:252-256) matches roles with strict equality and has no privilege hierarchy — yet docs imply a threshold reading (triggers.md:385 "based on repository permission level"; compilation-process.md:217 "actor has admin/maintainer/write permission"). A user who sets roles: [write] intending "write or above" will have their admin and maintainer actors rejected (admin !== write). The default [admin, maintainer, write] masks this by enumerating all three. Update the docs to state explicitly that roles is an exact-match allowlist (list every role you want to accept), not a minimum threshold.
Expected Impact
Eliminates a confirmed footgun. The behavior fails closed (over-restrictive), so it is a usability bug, not a security hole — a short doc clarification prevents users from silently locking out higher-privilege actors.
Suggested Agent
copilot-swe-agent or a docs-focused agent (two doc files).
Estimated Effort
Fast (< 30 min).
Data Source
DeepReport 2026-06-09 analysis — Schema Consistency Check (#38059). Note: the separate role_name runtime bug from the prior brief is now fixed; this is the remaining documentation gap.
Generated by 🔬 DeepReport - Intelligence Gathering Agent · 277.3 AIC · ⌖ 18.6 AIC · ⊞ 10.6K · ◷
Description
The
on.rolesruntime (actions/setup/js/check_permissions_utils.cjs:252-256) matches roles with strict equality and has no privilege hierarchy — yet docs imply a threshold reading (triggers.md:385"based on repository permission level";compilation-process.md:217"actor has admin/maintainer/write permission"). A user who setsroles: [write]intending "write or above" will have their admin and maintainer actors rejected (admin !== write). The default[admin, maintainer, write]masks this by enumerating all three. Update the docs to state explicitly thatrolesis an exact-match allowlist (list every role you want to accept), not a minimum threshold.Expected Impact
Eliminates a confirmed footgun. The behavior fails closed (over-restrictive), so it is a usability bug, not a security hole — a short doc clarification prevents users from silently locking out higher-privilege actors.
Suggested Agent
copilot-swe-agent or a docs-focused agent (two doc files).
Estimated Effort
Fast (< 30 min).
Data Source
DeepReport 2026-06-09 analysis — Schema Consistency Check (#38059). Note: the separate
role_nameruntime bug from the prior brief is now fixed; this is the remaining documentation gap.