Treat under-provisioned permissions as warnings in non-strict mode

[Copilot]

Under-provisioned GitHub MCP permissions previously always failed compilation. Users now get actionable warnings in non-strict mode with suggestions to either add missing permissions or reduce toolset requirements.

Changes

• Compiler behavior (compiler.go): Under-provisioned permissions emit warnings in non-strict mode, errors in strict mode
• Warning format (permissions_validator.go): Messages now include two fix options:
  • Add missing permissions to frontmatter
  • Reduce toolsets to match available permissions
• Tests (permissions_warning_test.go): Coverage for both warning and error modes

Example

Workflow with insufficient permissions:

---
permissions:
  contents: read
tools:
  github:
    toolsets: [repos, issues, pull_requests]
    read-only: false
---

Non-strict mode (default):

warning: Missing required permissions for github toolsets:
  - contents: write (required by repos)
  - issues: write (required by issues)
  - pull-requests: write (required by pull_requests)

To fix this, you can either:

Option 1: Add missing permissions to your workflow frontmatter:
permissions:
  contents: write
  issues: write
  pull-requests: write

Option 2: Reduce the required toolsets in your workflow:
Remove or adjust toolsets that require these permissions:
  - issues
  - pull_requests
  - repos

✓ Compiled 1 workflow(s): 0 error(s), 1 warning(s)

Strict mode (--strict):

error: Missing required permissions for github toolsets:
  ... (same message) ...

✗ Compiled 1 workflow(s): 1 error(s), 0 warning(s)

Original prompt

Treat under provisioned permissions as a warning in non-script mode. Suggest to add missing permissions or reduce the required toolsets.

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[github-actions]

Agentic Changeset Generator triggered by this pull request.

[Copilot]

Pull Request Overview

This PR changes how the compiler handles under-provisioned GitHub permissions for MCP toolsets. Previously, workflows with insufficient permissions always failed compilation. Now, non-strict mode emits actionable warnings that suggest either adding missing permissions or reducing toolset requirements, while strict mode continues to fail with errors.

Key Changes:

• Non-strict mode treats missing permissions as warnings instead of errors
• Warning messages now provide two concrete fix options with examples
• Strict mode behavior unchanged (still fails compilation)

Reviewed Changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
pkg/workflow/compiler.go	Adds conditional logic to emit warnings in non-strict mode vs errors in strict mode for missing permissions
pkg/workflow/permissions_validator.go	Enhances warning message format to include both "add permissions" and "reduce toolsets" options
pkg/workflow/permissions_validator_test.go	Updates test expectations to match new warning message format
pkg/workflow/permissions_warning_test.go	New comprehensive test suite covering warning/error behavior in both strict and non-strict modes
.github/workflows/example-permissions-warning.md	Example workflow demonstrating the new warning behavior with documentation

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.