Add workflows permission to schema

Add 'workflows' as a valid permission scope in the permissions-mapping
schema. The workflows permission supports only 'write' (or none),
matching the GitHub App permissions model where workflows: write
allows updating GitHub Actions workflow files.

This enables autocomplete and validation for 'permissions: workflows:'
in workflow YAML files.

expressions/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@actions/expressions",
-  "version": "0.3.52",
+  "version": "0.3.51",
   "license": "MIT",
   "type": "module",
   "source": "./src/index.ts",

languageserver/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@actions/languageserver",
-  "version": "0.3.52",
+  "version": "0.3.51",
   "description": "Language server for GitHub Actions",
   "license": "MIT",
   "type": "module",
@@ -48,8 +48,8 @@
     "actions-languageserver": "./bin/actions-languageserver"
   },
   "dependencies": {
-    "@actions/languageservice": "^0.3.52",
-    "@actions/workflow-parser": "^0.3.52",
+    "@actions/languageservice": "^0.3.51",
+    "@actions/workflow-parser": "^0.3.51",
     "@octokit/rest": "^21.1.1",
     "@octokit/types": "^9.0.0",
     "vscode-languageserver": "^8.0.2",

languageservice/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@actions/languageservice",
-  "version": "0.3.52",
+  "version": "0.3.51",
   "description": "Language service for GitHub Actions",
   "license": "MIT",
   "type": "module",
@@ -47,8 +47,8 @@
     "watch": "tsc --build tsconfig.build.json --watch"
   },
   "dependencies": {
-    "@actions/expressions": "^0.3.52",
-    "@actions/workflow-parser": "^0.3.52",
+    "@actions/expressions": "^0.3.51",
+    "@actions/workflow-parser": "^0.3.51",
     "vscode-languageserver-textdocument": "^1.0.7",
     "vscode-languageserver-types": "^3.17.2",
     "vscode-uri": "^3.0.8",

languageservice/src/complete.expressions.test.ts

@@ -1164,16 +1164,7 @@ jobs:
 `;
 
       const result = await complete(...getPositionFromCursor(input), {contextProviderConfig});
-      expect(result.map(x => x.label)).toEqual([
-        "check_run_id",
-        "container",
-        "services",
-        "status",
-        "workflow_file_path",
-        "workflow_ref",
-        "workflow_repository",
-        "workflow_sha"
-      ]);
+      expect(result.map(x => x.label)).toEqual(["check_run_id", "container", "services", "status"]);
     });
 
     it("job context is suggested within a job output", async () => {

languageservice/src/complete.test.ts

@@ -1016,6 +1016,45 @@ jobs:
   });
 });
 
+describe("permissions workflows completion", () => {
+  it("includes workflows in top-level permissions", async () => {
+    const input = `on: push
+permissions:
+  |`;
+    const result = await complete(...getPositionFromCursor(input));
+
+    expect(result).not.toBeUndefined();
+    const labels = result.map(x => x.label);
+    expect(labels).toContain("workflows");
+  });
+
+  it("offers only write and none for workflows", async () => {
+    const input = `on: push
+permissions:
+  workflows: |`;
+    const result = await complete(...getPositionFromCursor(input));
+
+    expect(result).not.toBeUndefined();
+    const labels = result.map(x => x.label);
+    expect(labels).toContain("write");
+    expect(labels).not.toContain("read");
+  });
+
+  it("includes workflows in job-level permissions", async () => {
+    const input = `on: push
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    permissions:
+      |`;
+    const result = await complete(...getPositionFromCursor(input));
+
+    expect(result).not.toBeUndefined();
+    const labels = result.map(x => x.label);
+    expect(labels).toContain("workflows");
+  });
+});
+
 describe("service container command/entrypoint completion", () => {
   it("suggests entrypoint and command in service container", async () => {
     const input = `on: push

languageservice/src/context-providers/descriptions.json

@@ -218,18 +218,6 @@
     },
     "check_run_id": {
       "description": "The unique identifier of the check run for this job."
-    },
-    "workflow_file_path": {
-      "description": "The path of the workflow file that contains the job. For example, `.github/workflows/my-workflow.yml`."
-    },
-    "workflow_ref": {
-      "description": "The ref path to the workflow file that contains the job. For example, `octocat/hello-world/.github/workflows/my-workflow.yml@refs/heads/my_branch`."
-    },
-    "workflow_repository": {
-      "description": "The owner and repository name of the workflow file that contains the job. For example, `octocat/Hello-World`."
-    },
-    "workflow_sha": {
-      "description": "The commit SHA of the workflow file that contains the job."
     }
   },
   "secrets": {

languageservice/src/context-providers/job.test.ts

@@ -18,16 +18,12 @@ describe("job context", () => {
     expect(context.pairs().length).toBe(0);
   });
 
-  it("returns status, check_run_id, and workflow fields when job has no container or services", () => {
+  it("returns status and check_run_id when job has no container or services", () => {
     const workflowContext = {job: {}} as WorkflowContext;
     const context = getJobContext(workflowContext);
 
     expect(context.get("status")).toBeDefined();
     expect(context.get("check_run_id")).toBeDefined();
-    expect(context.get("workflow_ref")).toBeDefined();
-    expect(context.get("workflow_sha")).toBeDefined();
-    expect(context.get("workflow_repository")).toBeDefined();
-    expect(context.get("workflow_file_path")).toBeDefined();
     expect(context.get("container")).toBeUndefined();
     expect(context.get("services")).toBeUndefined();
   });
@@ -177,21 +173,4 @@ describe("job context", () => {
       expect(redis.getDescription("ports")).toBeDefined();
     });
   });
-
-  describe("workflow context fields", () => {
-    it("includes workflow context fields with descriptions", () => {
-      const workflowContext = {job: {}} as WorkflowContext;
-      const context = getJobContext(workflowContext);
-
-      expect(context.get("workflow_ref")).toBeDefined();
-      expect(context.get("workflow_sha")).toBeDefined();
-      expect(context.get("workflow_repository")).toBeDefined();
-      expect(context.get("workflow_file_path")).toBeDefined();
-
-      expect(context.getDescription("workflow_ref")).toBeDefined();
-      expect(context.getDescription("workflow_sha")).toBeDefined();
-      expect(context.getDescription("workflow_repository")).toBeDefined();
-      expect(context.getDescription("workflow_file_path")).toBeDefined();
-    });
-  });
 });

languageservice/src/context-providers/job.ts

@@ -5,7 +5,7 @@ import {WorkflowContext} from "../context/workflow-context.js";
 import {getDescription} from "./descriptions.js";
 
 /**
- * Returns the job context with container, services, status, check_run_id, and workflow identity fields.
+ * Returns the job context with container, services, status, and check_run_id.
  */
 export function getJobContext(workflowContext: WorkflowContext): DescriptionDictionary {
   // https://docs.github.com/en/actions/learn-github-actions/contexts#job-context
@@ -42,12 +42,6 @@ export function getJobContext(workflowContext: WorkflowContext): DescriptionDict
   // Check run ID
   jobContext.add("check_run_id", new data.StringData(""), getDescription("job", "check_run_id"));
 
-  // Workflow context fields (populated at runtime for reusable workflow jobs)
-  jobContext.add("workflow_file_path", new data.StringData(""), getDescription("job", "workflow_file_path"));
-  jobContext.add("workflow_ref", new data.StringData(""), getDescription("job", "workflow_ref"));
-  jobContext.add("workflow_repository", new data.StringData(""), getDescription("job", "workflow_repository"));
-  jobContext.add("workflow_sha", new data.StringData(""), getDescription("job", "workflow_sha"));
-
   return jobContext;
 }
 

languageservice/src/validate.expressions.test.ts

@@ -432,24 +432,6 @@ jobs:
       expect(result).toEqual([]);
     });
 
-    it("job.workflow_* fields", async () => {
-      const input = `
-on: push
-
-jobs:
-  test:
-    runs-on: ubuntu-latest
-    steps:
-      - run: echo \${{ job.workflow_ref }}
-      - run: echo \${{ job.workflow_sha }}
-      - run: echo \${{ job.workflow_repository }}
-      - run: echo \${{ job.workflow_file_path }}
-`;
-      const result = await validate(createDocument("wf.yaml", input));
-
-      expect(result).toEqual([]);
-    });
-
     it("job.services.<service_id>", async () => {
       const input = `
 on: push

lerna.json

@@ -6,5 +6,5 @@
     "languageservice",
     "languageserver"
   ],
-  "version": "0.3.52"
+  "version": "0.3.51"
 }

package-lock.json

@@ -136,7 +136,7 @@
     },
     "expressions": {
       "name": "@actions/expressions",
-      "version": "0.3.52",
+      "version": "0.3.51",
       "license": "MIT",
       "devDependencies": {
         "@types/jest": "^29.0.3",
@@ -396,11 +396,11 @@
     },
     "languageserver": {
       "name": "@actions/languageserver",
-      "version": "0.3.52",
+      "version": "0.3.51",
       "license": "MIT",
       "dependencies": {
-        "@actions/languageservice": "^0.3.52",
-        "@actions/workflow-parser": "^0.3.52",
+        "@actions/languageservice": "^0.3.51",
+        "@actions/workflow-parser": "^0.3.51",
         "@octokit/rest": "^21.1.1",
         "@octokit/types": "^9.0.0",
         "vscode-languageserver": "^8.0.2",
@@ -927,11 +927,11 @@
     },
     "languageservice": {
       "name": "@actions/languageservice",
-      "version": "0.3.52",
+      "version": "0.3.51",
       "license": "MIT",
       "dependencies": {
-        "@actions/expressions": "^0.3.52",
-        "@actions/workflow-parser": "^0.3.52",
+        "@actions/expressions": "^0.3.51",
+        "@actions/workflow-parser": "^0.3.51",
         "vscode-languageserver-textdocument": "^1.0.7",
         "vscode-languageserver-types": "^3.17.2",
         "vscode-uri": "^3.0.8",
@@ -14020,10 +14020,10 @@
     },
     "workflow-parser": {
       "name": "@actions/workflow-parser",
-      "version": "0.3.52",
+      "version": "0.3.51",
       "license": "MIT",
       "dependencies": {
-        "@actions/expressions": "^0.3.52",
+        "@actions/expressions": "^0.3.51",
         "cronstrue": "^2.21.0",
         "yaml": "^2.0.0-8"
       },

workflow-parser/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@actions/workflow-parser",
-  "version": "0.3.52",
+  "version": "0.3.51",
   "license": "MIT",
   "type": "module",
   "source": "./src/index.ts",
@@ -48,7 +48,7 @@
     "watch": "tsc --build tsconfig.build.json --watch"
   },
   "dependencies": {
-    "@actions/expressions": "^0.3.52",
+    "@actions/expressions": "^0.3.51",
     "cronstrue": "^2.21.0",
     "yaml": "^2.0.0-8"
   },

workflow-parser/src/workflow-v1.0.json

@@ -1649,6 +1649,10 @@
           "statuses": {
             "type": "permission-level-any",
             "description": "Commit statuses."
+          },
+          "workflows": {
+            "type": "permission-level-write-or-no-access",
+            "description": "Update GitHub Actions workflow files."
           }
         }
       }