-
Notifications
You must be signed in to change notification settings - Fork 47
Add permissions validator for GitHub MCP toolsets #2768
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
Merged
Changes from all commits
Commits
Show all changes
6 commits
Select commit
Hold shift + click to select a range
cd9a7f6
Initial plan
Copilot 544eab8
Initial exploration complete - planning permissions validation checker
Copilot 7a34f26
Add permissions validation checker with comprehensive tests
Copilot 9f1aaed
Integrate permissions validation into compilation process
Copilot 9dc42ba
Fix test workflows with required permissions (partial)
Copilot 63576b4
Refactor GitHub toolsets parsing to separate file with tests
Copilot File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.
Oops, something went wrong.
Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.
Oops, something went wrong.
Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.
Oops, something went wrong.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,55 @@ | ||
| package workflow | ||
|
|
||
| import ( | ||
| "strings" | ||
| ) | ||
|
|
||
| // DefaultGitHubToolsets defines the toolsets that are enabled by default | ||
| // when toolsets are not explicitly specified in the GitHub MCP configuration. | ||
| // These match the documented default toolsets in github-mcp-server.instructions.md | ||
| var DefaultGitHubToolsets = []string{"context", "repos", "issues", "pull_requests", "users"} | ||
|
|
||
| // ParseGitHubToolsets parses the toolsets string and expands "default" and "all" | ||
| // into their constituent toolsets. It handles comma-separated lists and deduplicates. | ||
| func ParseGitHubToolsets(toolsetsStr string) []string { | ||
| if toolsetsStr == "" { | ||
| return DefaultGitHubToolsets | ||
| } | ||
|
|
||
| toolsets := strings.Split(toolsetsStr, ",") | ||
| var expanded []string | ||
| seenToolsets := make(map[string]bool) | ||
|
|
||
| for _, toolset := range toolsets { | ||
| toolset = strings.TrimSpace(toolset) | ||
| if toolset == "" { | ||
| continue | ||
| } | ||
|
|
||
| if toolset == "default" { | ||
| // Add default toolsets | ||
| for _, dt := range DefaultGitHubToolsets { | ||
| if !seenToolsets[dt] { | ||
| expanded = append(expanded, dt) | ||
| seenToolsets[dt] = true | ||
| } | ||
| } | ||
| } else if toolset == "all" { | ||
| // Add all toolsets from the toolset permissions map | ||
| for t := range toolsetPermissionsMap { | ||
| if !seenToolsets[t] { | ||
| expanded = append(expanded, t) | ||
| seenToolsets[t] = true | ||
| } | ||
| } | ||
| } else { | ||
| // Add individual toolset | ||
| if !seenToolsets[toolset] { | ||
| expanded = append(expanded, toolset) | ||
| seenToolsets[toolset] = true | ||
| } | ||
| } | ||
| } | ||
|
|
||
| return expanded | ||
| } | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,165 @@ | ||
| package workflow | ||
|
|
||
| import ( | ||
| "testing" | ||
| ) | ||
|
|
||
| func TestDefaultGitHubToolsets(t *testing.T) { | ||
| // Verify the default toolsets match the documented defaults | ||
| expected := []string{"context", "repos", "issues", "pull_requests", "users"} | ||
|
|
||
| if len(DefaultGitHubToolsets) != len(expected) { | ||
| t.Errorf("Expected %d default toolsets, got %d", len(expected), len(DefaultGitHubToolsets)) | ||
| } | ||
|
|
||
| for i, toolset := range expected { | ||
| if i >= len(DefaultGitHubToolsets) || DefaultGitHubToolsets[i] != toolset { | ||
| t.Errorf("Expected default toolset[%d] to be %s, got %s", i, toolset, DefaultGitHubToolsets[i]) | ||
| } | ||
| } | ||
| } | ||
|
|
||
| func TestParseGitHubToolsets(t *testing.T) { | ||
| tests := []struct { | ||
| name string | ||
| input string | ||
| expected []string | ||
| }{ | ||
| { | ||
| name: "Empty string returns default", | ||
| input: "", | ||
| expected: []string{"context", "repos", "issues", "pull_requests", "users"}, | ||
| }, | ||
| { | ||
| name: "Default expands to default toolsets", | ||
| input: "default", | ||
| expected: []string{"context", "repos", "issues", "pull_requests", "users"}, | ||
| }, | ||
| { | ||
| name: "Specific toolsets", | ||
| input: "repos,issues", | ||
| expected: []string{"repos", "issues"}, | ||
| }, | ||
| { | ||
| name: "Default plus additional", | ||
| input: "default,discussions", | ||
| expected: []string{"context", "repos", "issues", "pull_requests", "users", "discussions"}, | ||
| }, | ||
| { | ||
| name: "All expands to all toolsets", | ||
| input: "all", | ||
| // Should include all 19 toolsets - we'll check the count | ||
| expected: nil, | ||
| }, | ||
| { | ||
| name: "Deduplication", | ||
| input: "repos,issues,repos", | ||
| expected: []string{"repos", "issues"}, | ||
| }, | ||
| { | ||
| name: "Whitespace handling", | ||
| input: " repos , issues , pull_requests ", | ||
| expected: []string{"repos", "issues", "pull_requests"}, | ||
| }, | ||
| { | ||
| name: "Single toolset", | ||
| input: "actions", | ||
| expected: []string{"actions"}, | ||
| }, | ||
| { | ||
| name: "Multiple with default in middle", | ||
| input: "actions,default,discussions", | ||
| expected: []string{"actions", "context", "repos", "issues", "pull_requests", "users", "discussions"}, | ||
| }, | ||
| } | ||
|
|
||
| for _, tt := range tests { | ||
| t.Run(tt.name, func(t *testing.T) { | ||
| result := ParseGitHubToolsets(tt.input) | ||
|
|
||
| if tt.name == "All expands to all toolsets" { | ||
| // Check that all toolsets are present | ||
| if len(result) != len(toolsetPermissionsMap) { | ||
| t.Errorf("Expected %d toolsets for 'all', got %d", len(toolsetPermissionsMap), len(result)) | ||
| } | ||
| return | ||
| } | ||
|
|
||
| if len(result) != len(tt.expected) { | ||
| t.Errorf("Expected %d toolsets, got %d: %v", len(tt.expected), len(result), result) | ||
| return | ||
| } | ||
|
|
||
| // Check that all expected toolsets are present (order doesn't matter for some tests) | ||
| resultMap := make(map[string]bool) | ||
| for _, ts := range result { | ||
| resultMap[ts] = true | ||
| } | ||
|
|
||
| for _, expected := range tt.expected { | ||
| if !resultMap[expected] { | ||
| t.Errorf("Expected toolset %s not found in result: %v", expected, result) | ||
| } | ||
| } | ||
| }) | ||
| } | ||
| } | ||
|
|
||
| func TestParseGitHubToolsetsPreservesOrder(t *testing.T) { | ||
| // Test that specific toolsets maintain their order | ||
| input := "repos,issues,pull_requests" | ||
| result := ParseGitHubToolsets(input) | ||
| expected := []string{"repos", "issues", "pull_requests"} | ||
|
|
||
| if len(result) != len(expected) { | ||
| t.Fatalf("Expected %d toolsets, got %d", len(expected), len(result)) | ||
| } | ||
|
|
||
| for i, toolset := range expected { | ||
| if result[i] != toolset { | ||
| t.Errorf("Expected toolset[%d] to be %s, got %s", i, toolset, result[i]) | ||
| } | ||
| } | ||
| } | ||
|
|
||
| func TestParseGitHubToolsetsDeduplication(t *testing.T) { | ||
| tests := []struct { | ||
| name string | ||
| input string | ||
| expected int | ||
| }{ | ||
| { | ||
| name: "Duplicate in simple list", | ||
| input: "repos,issues,repos,issues", | ||
| expected: 2, | ||
| }, | ||
| { | ||
| name: "Default includes duplicates", | ||
| input: "context,default", | ||
| expected: 5, // context already in default, so only 5 unique | ||
| }, | ||
| { | ||
| name: "All with duplicates", | ||
| input: "all,repos,issues", | ||
| expected: len(toolsetPermissionsMap), // All toolsets, duplicates ignored | ||
| }, | ||
| } | ||
|
|
||
| for _, tt := range tests { | ||
| t.Run(tt.name, func(t *testing.T) { | ||
| result := ParseGitHubToolsets(tt.input) | ||
| if len(result) != tt.expected { | ||
| t.Errorf("Expected %d unique toolsets, got %d: %v", tt.expected, len(result), result) | ||
| } | ||
|
|
||
| // Verify no duplicates | ||
| seen := make(map[string]bool) | ||
| for _, toolset := range result { | ||
| if seen[toolset] { | ||
| t.Errorf("Found duplicate toolset: %s", toolset) | ||
| } | ||
| seen[toolset] = true | ||
| } | ||
| }) | ||
| } | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The function depends on the global
toolsetPermissionsMapvariable which creates tight coupling. Consider passing the toolset map as a parameter or making it a method on a struct to improve testability and modularity.