fix: restore permission-discussions in GitHub App token fields

[lpcox]

Summary

Reverts the regression introduced by PR #25508, which removed permission-discussions from the convertPermissionsToAppTokenFields() function.

Root Cause

PR #25508 was based on two incorrect assumptions about actions/create-github-app-token:

1. "Unsupported inputs are silently ignored"

Wrong. The action reads all INPUT_PERMISSION-* environment variables from process.env, not just declared inputs (source):

GitHub Actions sets INPUT_PERMISSION-DISCUSSIONS for any with: permission-discussions: field, so the value IS forwarded to the GitHub API despite the "Unexpected input" warning in the logs.

2. "Tokens inherit full installation permissions by default"

Only partially true. This is only the case when zero permission-* inputs are specified. When any permission-* field is set (which the compiler always does — permission-contents, permission-issues, etc.), the token is explicitly scoped to only those permissions:

// Returns undefined (inherit all) only when no permissions found
}, undefined);

Omitting permission-discussions causes the minted token to lack discussions access even when the GitHub App installation has that permission.

Impact

• create-discussion safe-outputs fail with permissions errors
• Falls back to issue creation (if fallback-to-issue: true)
• Affects all workflows using GitHub App auth with discussion safe-outputs

Changes

• safe_outputs_app_config.go: Restore permission-discussions mapping with corrected comment explaining the actual behavior
• safe_outputs_app_test.go: Update test to assert permission-discussions: write IS present
• github_app_permissions_validation_test.go: Update test to verify discussions permission IS mapped

Testing

• All modified tests pass (TestSafeOutputsAppTokenDiscussionsPermission, TestConvertPermissionsToAppTokenFields_GitHubAppOnly)
• Pre-existing test failures unrelated to this change

Closes #25704

[pelikhan]

@lpcox the actions/create... needs to fix the warning

[pelikhan]

@salmanmkc

[Copilot]

Pull request overview

Restores permission-discussions generation for GitHub App token minting so safe-outputs that create discussions request the correct scoped permissions again (regression from PR #25508).

Changes:

• Re-add PermissionDiscussions → permission-discussions mapping in convertPermissionsToAppTokenFields(), with updated rationale comment.
• Update safe-outputs workflow compilation test to assert permission-discussions: write is emitted for create-discussion.
• Update GitHub App permissions mapping validation test to expect permission-discussions to be present.

Show a summary per file

File	Description
pkg/workflow/safe_outputs_app_config.go	Restores discussions permission mapping for GitHub App token with: permission-* fields.
pkg/workflow/safe_outputs_app_test.go	Updates test expectations to require permission-discussions: write in the minted-token step.
pkg/workflow/github_app_permissions_validation_test.go	Updates mapping validation test to expect permission-discussions output.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 3/3 changed files
• Comments generated: 0

[salmanmkc]

@salmanmkc

this should fix it
actions/create-github-app-token#359
actions/create-github-app-token#360

some override seems like was a snapshot and is now outdated, updated this too, this is upstream and if this was right then the above pr wouldn't be needed either octokit/openapi#529

this also seems to fix it http://github.com/actions/create-github-app-token/pull/358l

[ahamedjobayer081-spec]

1. 1