fix: authorize custom org repository roles via base permission by Copilot · Pull Request #45641 · github/gh-aw

Copilot · 2026-07-15T06:03:27Z

Since #37959, checkRepositoryPermission prefers role_name over permission for authorization. Custom org repository roles (e.g. Security Champions) set role_name to their custom string, which never matches any on.roles value — making them permanently unauthorizable even when their base permission (write) is in the required set.

Changes

check_permissions_utils.cjs: Defines a STANDARD_ROLES set (admin, maintain, write, triage, read). When role_name is a custom (non-standard) role, also checks normalizedPermission in the hasPermission evaluation. Standard roles retain exact role_name matching, preserving Honor role_name in runtime role authorization for on.roles (maintain/triage) #37959's maintain/triage precision.
check_permissions_utils.test.cjs: Adds two fixtures for the custom role case — authorized when base permission matches, rejected when it does not.

// Before: rejected — "Security Champions" !== "write"
{ permission: "write", role_name: "Security Champions" }  // required: ["admin", "maintain", "write"]

// After: authorized via base permission fallback

The maintain-over-write exact-match behavior from #37959 is unchanged: a user with role_name: "maintain" is still rejected if only write is required.

…yPermission Custom organization repository roles (e.g. "Security Champions") return a non-standard role_name from the GitHub API alongside a base permission (e.g. "write"). The previous logic used role_name exclusively when present, causing these roles to be rejected since their name doesn't match any on.roles enum value. Fix: for standard GitHub roles (admin, maintain, write, triage, read) keep exact role_name matching (preserving #37959's maintain/triage precision). For custom org roles, also check the base permission so that an actor whose custom role confers write is authorized when write is in the required set. Adds two test cases covering: (1) custom role authorized via base permission, (2) custom role rejected when base permission is insufficient. Closes #45536 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

…case Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

pelikhan · 2026-07-15T06:18:28Z

@copilot update specification

…nd glossary Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-07-15T06:24:40Z

@copilot update specification

Updated in commit docs: document custom org role base-permission fallback in triggers and glossary:

docs/src/content/docs/reference/triggers.md: Added a "Custom organization repository roles" subsection explaining that actors with custom org roles are authorized via their base permission (e.g. a user with role Security Champions (base: write) is authorized when write is in the required set).
docs/src/content/docs/reference/glossary.md: Updated the Role Filtering entry to note that custom org role actors are matched on the base permission the role confers, not the custom role name.

github-actions · 2026-07-15T07:09:42Z

🤖 PR Triage

Field	Value
Category	bug
Risk	medium
Score	65/100 (impact:35, urgency:18, quality:12)
Action	fast_track

Authorizes custom org repository roles via base permission — fixes access denial for roles like 'Security Champions'. Draft, small change (+46/-4). Undraft and verify via CI.

Generated by 🔧 PR Triage Agent · 143.8 AIC · ⌖ 7.64 AIC · ⊞ 5.6K · ◷

github-actions · 2026-07-15T07:30:08Z

✅ Test Quality Sentinel completed test quality analysis.

github-actions · 2026-07-15T07:30:11Z

✅ PR Code Quality Reviewer completed the code quality review.

Copilot

Pull request overview

Adds authorization fallback for custom repository roles based on their reported permission level.

Changes:

Adds custom-role detection and permission fallback.
Adds matching and rejection tests.
Documents custom-role behavior.

Show a summary per file

File	Description
`actions/setup/js/check_permissions_utils.cjs`	Implements custom-role authorization.
`actions/setup/js/check_permissions_utils.test.cjs`	Tests custom-role outcomes.
`docs/src/content/docs/reference/triggers.md`	Documents trigger behavior.
`docs/src/content/docs/reference/glossary.md`	Updates role-filtering terminology.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 4/4 changed files
Comments generated: 1
Review effort level: Medium

    const hasPermission = requiredPermissions.some(requiredPerm => {
      const normalizedRequired = requiredPerm === "maintainer" ? "maintain" : requiredPerm;
-      return normalizedRequired === effectiveRole;
+      return normalizedRequired === effectiveRole || (isCustomRole && normalizedRequired === normalizedPermission);


github-actions · 2026-07-15T07:30:17Z

🧠 Matt Pocock Skills Reviewer has completed the skills-based review. ✅

github-actions · 2026-07-15T07:30:41Z

✅ Design Decision Gate 🏗️ completed the design decision gate check.

No ADR enforcement needed: PR does not have the 'implementation' label and has ≤100 new lines of code in business logic directories (0 additions in default business logic dirs: src/, lib/, pkg/, internal/, app/, core/, domain/, services/, api/).

gh-aw-bot · 2026-07-15T07:32:25Z

pr-sous-chef
@copilot please run the pr-finisher skill, refresh this branch for the latest base branch state if needed, and rerun checks once finished.

Run: https://github.com/github/gh-aw/actions/runs/29397228615

Generated by 👨‍🍳 PR Sous Chef · 13.6 AIC · ⌖ 6.54 AIC · ⊞ 5.1K · ◷
_{Comment /souschef to run again}

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot · 2026-07-15T08:50:14Z

@copilot please run the pr-finisher skill, address any unresolved review feedback, refresh the branch if needed, and rerun checks once updates are complete.

...

Addressed in 6d19a2a. I refreshed the branch with origin/main, kept the custom-role authorization/test coverage intact, and reran local validation (actions/setup/js typecheck + targeted tests, then make fmt, make lint, make test-unit, make test, make recompile, and make agent-report-progress). The earlier CJS failure was the pre-refresh awf_reflect typecheck issue, and the Smoke CI failure was an agent missing-tool/incomplete-run case. CI on this HEAD is still unverified until a maintainer re-triggers it.

pelikhan · 2026-07-15T08:54:26Z

@copilot use the w3c-specification-writer agent to update the safe outputs specification

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-07-15T09:08:21Z

@copilot use the w3c-specification-writer agent to update the safe outputs specification

Addressed in 7f36978.

Updated the safe outputs replay docs and the W3C-style safe outputs specification to require exact admin/maintain authorization, document inherited standard-role resolution for custom organization repository roles, and specify fail-closed behavior when GitHub does not provide the inherited role.

pelikhan · 2026-07-15T10:59:59Z

@copilot add logging for debugability

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-07-15T11:24:10Z

@copilot add logging for debugability

Addressed in 9224d6c.

Added debug logging around repository permission resolution so custom-role authorization is easier to trace: raw API permission fields, computed effective/inherited roles, match path (effective-role vs inherited-standard-role), and the fail-closed case when inherited-role metadata is missing. Verified with make lint-cjs, npm run typecheck, targeted check_permissions_utils tests, make agent-report-progress, and final PR validation.

gh-aw-bot · 2026-07-15T11:50:17Z

@copilot please run the pr-finisher skill, address unresolved review comments, and rerun checks once the branch is up to date.

Generated by 👨‍🍳 PR Sous Chef · 6.57 AIC · ⌖ 15.8 AIC · ⊞ 7.5K · ◷
_{Comment /souschef to run again}

…custom-org-repository-roles Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot · 2026-07-15T12:10:33Z

@copilot please run the pr-finisher skill, address unresolved review comments, and rerun checks once the branch is up to date.

...

Addressed in a5b0da2. I refreshed the branch with origin/main, reviewed the unresolved in-scope feedback against the current branch state, and reran local validation. actions/setup/js typecheck plus targeted check_permissions_utils tests passed, make fmt and make lint passed, and the full make test-unit/make test/make agent-report-progress runs still fail on pre-existing pkg/cli bootstrap tests that try to read github/central-agentic-ops over the blocked public API path in this sandbox. CI on this HEAD is unverified until a maintainer re-triggers it.

gh-aw-bot · 2026-07-15T12:28:11Z

pr-sous-chef
@copilot please run the pr-finisher skill, reconcile the remaining instability with the current review state, keep the custom-role logging/docs changes coherent, and rerun checks once the branch is up to date.

Run: https://github.com/github/gh-aw/actions/runs/29414813374

Generated by 👨‍🍳 PR Sous Chef · 15.4 AIC · ⌖ 5.73 AIC · ⊞ 7.5K · ◷
_{Comment /souschef to run again}

github-actions · 2026-07-16T06:42:30Z

🎉 This pull request is included in a new release.

Release: v0.82.10

Initial plan

8928729

Copilot AI assigned Copilot and pelikhan Jul 15, 2026

Copilot started work on behalf of pelikhan July 15, 2026 06:04 View session

Copilot AI linked an issue Jul 15, 2026 that may be closed by this pull request

on.roles rejects custom org repository roles despite base write permission (regression from #37959) #45536

Closed

Copilot AI and others added 2 commits July 15, 2026 06:09

test: use canonical 'maintain' over 'maintainer' in custom role test …

05e9d3c

…case Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Fix on.roles rejection of custom org repository roles~~ fix: authorize custom org repository roles via base permission Jul 15, 2026

Copilot finished work on behalf of pelikhan July 15, 2026 06:10

Copilot AI requested a review from pelikhan July 15, 2026 06:10

Copilot started work on behalf of pelikhan July 15, 2026 06:19 View session

docs: document custom org role base-permission fallback in triggers a…

d2d24f5

…nd glossary Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan July 15, 2026 06:24

github-actions Bot added pr-action:fast_track pr-agent:copilot-swe-agent pr-priority:high pr-risk:medium pr-type:bug labels Jul 15, 2026

pelikhan marked this pull request as ready for review July 15, 2026 07:23

Copilot AI review requested due to automatic review settings July 15, 2026 07:23

Copilot started reviewing on behalf of pelikhan July 15, 2026 07:23 View session

Copilot AI reviewed Jul 15, 2026

View reviewed changes

Copilot started work on behalf of gh-aw-bot July 15, 2026 08:36 View session

Merge origin/main into copilot/fix-on-roles-custom-org-repository-roles

6d19a2a

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot finished work on behalf of gh-aw-bot July 15, 2026 08:50

Copilot started work on behalf of pelikhan July 15, 2026 08:54 View session

docs: clarify safe outputs replay auth for custom roles

7f36978

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan July 15, 2026 09:08

Copilot started work on behalf of pelikhan July 15, 2026 11:00 View session

Copilot AI and others added 4 commits July 15, 2026 11:12

chore: add permission resolution debug logs

85758a1

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

refactor: split permission debug logging

8148beb

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

refactor: narrow permission match state

e3cc02e

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

refactor: reuse role normalization helper

9224d6c

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan July 15, 2026 11:24

Copilot started work on behalf of gh-aw-bot July 15, 2026 11:50 View session

Merge remote-tracking branch 'origin/main' into copilot/fix-on-roles-…

a5b0da2

…custom-org-repository-roles Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot finished work on behalf of gh-aw-bot July 15, 2026 12:11

pelikhan merged commit 73443f4 into main Jul 15, 2026

pelikhan deleted the copilot/fix-on-roles-custom-org-repository-roles branch July 15, 2026 12:25

Etienne-M mentioned this pull request Aug 3, 2026

check_permissions: inherited_role does not exist in the GitHub API, so custom repository roles are always denied #50068

Closed

This was referenced Aug 4, 2026

[WIP] Fix inherited_role issue in check_permissions #50148

Closed

[WIP] Fix check_permissions to handle missing inherited_role field #50183

Merged

coderabbitai Bot mentioned this pull request Aug 11, 2026

Give issues and pull requests a first reader HardMax71/amiss#368

Merged

Uh oh!

Conversation

Copilot AI commented Jul 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Uh oh!

pelikhan commented Jul 15, 2026

Uh oh!

Copilot AI commented Jul 15, 2026

Uh oh!

github-actions Bot commented Jul 15, 2026

🤖 PR Triage

Uh oh!

github-actions Bot commented Jul 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

github-actions Bot commented Jul 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

gh-aw-bot commented Jul 15, 2026

Uh oh!

Copilot AI commented Jul 15, 2026

Uh oh!

pelikhan commented Jul 15, 2026

Uh oh!

Copilot AI commented Jul 15, 2026

Uh oh!

pelikhan commented Jul 15, 2026

Uh oh!

Copilot AI commented Jul 15, 2026

Uh oh!

gh-aw-bot commented Jul 15, 2026

Uh oh!

Copilot AI commented Jul 15, 2026

Uh oh!

gh-aw-bot commented Jul 15, 2026

Uh oh!

github-actions Bot commented Jul 16, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Copilot AI commented Jul 15, 2026 •

edited

Loading

github-actions Bot commented Jul 15, 2026 •

edited

Loading

github-actions Bot commented Jul 15, 2026 •

edited

Loading

github-actions Bot commented Jul 15, 2026 •

edited

Loading

github-actions Bot commented Jul 15, 2026 •

edited

Loading