Remove automatic contents read permission requirement#16539
Closed
Remove automatic contents read permission requirement#16539
Conversation
The agent job no longer automatically adds contents:read permission. This was previously required to read the prompt from the repository, but the prompt is no longer read from the repo. Changes: - Updated buildMainJob() to only add contents:read when: 1. User explicitly specifies permissions: contents: read, OR 2. In development/script mode when local actions need checkout - Updated permissions_explicit_empty_test.go expectations - Added new test TestAgentJobPermissionsConditional to verify conditional behavior - All existing permission tests pass Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Copilot stopped work on behalf of
pelikhan due to an error
February 18, 2026 07:31
Contributor
|
@copilot Keep working |
Contributor
Author
Full validation completed successfully:
Ready for review. Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
Copilot
AI
changed the title
[WIP] Remove automatic contents read permission requirement
Remove automatic contents read permission requirement
Feb 18, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Remove automatic contents:read from agent job
The agent job no longer needs automatic
contents: readpermission. This was previously required to read the prompt from the repository, but the prompt is no longer read from the repo.Changes Summary:
✅ Updated
buildMainJob()incompiler_activation_jobs.goto conditionally addcontents: read:permissions: contents: readin frontmatter✅ Removed unconditional
contents: readaddition logic (lines 918-934)✅ Added conditional logic to check if dev/script mode AND checkout is needed
✅ Updated tests:
permissions_explicit_empty_test.goexpectationsTestAgentJobPermissionsConditionalto verify conditional behavior✅ Full validation completed:
Behavior:
permissions: {}(no automatic contents:read)permissions: contents: read(for checkout)The changes are minimal and focused, affecting only the permission logic for the agent job without altering any other functionality.
💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.