Add workflows permission to schema

Add 'workflows' as a valid permission scope in the permissions-mapping
schema. The workflows permission supports only 'write' (or none),
matching the GitHub App permissions model where workflows: write
allows updating GitHub Actions workflow files.

This enables autocomplete and validation for 'permissions: workflows:'
in workflow YAML files.

languageservice/src/complete.test.ts

@@ -1016,6 +1016,45 @@ jobs:
   });
 });
 
+describe("permissions workflows completion", () => {
+  it("includes workflows in top-level permissions", async () => {
+    const input = `on: push
+permissions:
+  |`;
+    const result = await complete(...getPositionFromCursor(input));
+
+    expect(result).not.toBeUndefined();
+    const labels = result.map(x => x.label);
+    expect(labels).toContain("workflows");
+  });
+
+  it("offers only write and none for workflows", async () => {
+    const input = `on: push
+permissions:
+  workflows: |`;
+    const result = await complete(...getPositionFromCursor(input));
+
+    expect(result).not.toBeUndefined();
+    const labels = result.map(x => x.label);
+    expect(labels).toContain("write");
+    expect(labels).not.toContain("read");
+  });
+
+  it("includes workflows in job-level permissions", async () => {
+    const input = `on: push
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    permissions:
+      |`;
+    const result = await complete(...getPositionFromCursor(input));
+
+    expect(result).not.toBeUndefined();
+    const labels = result.map(x => x.label);
+    expect(labels).toContain("workflows");
+  });
+});
+
 describe("service container command/entrypoint completion", () => {
   it("suggests entrypoint and command in service container", async () => {
     const input = `on: push

languageservice/src/context-providers/descriptions.json

@@ -105,13 +105,6 @@
     "job": {
       "description": "The [`job_id`](https://docs.github.com/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_id) of the current job.\nNote: This context property is set by the Actions runner, and is only available within the execution `steps` of a job. Otherwise, the value of this property will be `null`."
     },
-    "job_workflow_sha": {
-      "description": "For jobs using a reusable workflow, the commit SHA for the reusable workflow file.",
-      "versions": {
-        "ghes": ">=3.9",
-        "ghae": ">=3.9"
-      }
-    },
     "path": {
       "description": "Path on the runner to the file that sets system PATH variables from workflow commands. This file is unique to the current step and is a different file for each step in a job. For more information, see \"[Workflow commands for GitHub Actions](https://docs.github.com/actions/using-workflows/workflow-commands-for-github-actions#adding-a-system-path).\""
     },

languageservice/src/context-providers/github.ts

@@ -29,7 +29,6 @@ export function getGithubContext(workflowContext: WorkflowContext | undefined, m
     "graphql_url",
     "head_ref",
     "job",
-    "job_workflow_sha",
     "path",
     "ref",
     "ref_name",

workflow-parser/src/workflow-v1.0.json

@@ -1649,6 +1649,10 @@
           "statuses": {
             "type": "permission-level-any",
             "description": "Commit statuses."
+          },
+          "workflows": {
+            "type": "permission-level-write-or-no-access",
+            "description": "Update GitHub Actions workflow files."
           }
         }
       }