- Scope filtering only applies to classic PATs which return X-OAuth-Scopes
- Fine-grained PATs and other token types skip filtering (all tools shown)
- Updated docs to clarify PAT filtering vs OAuth scope challenges
Scope filtering is now a built-in feature rather than a configurable option.
The server automatically fetches token scopes at startup and filters tools
accordingly. If scope detection fails, it logs a warning and continues with
all tools available.
Add the ability to filter tools based on token scopes for PAT users.
This uses an HTTP HEAD request to GitHub's API to discover token scopes.
New components:
- pkg/scopes/filter.go: HasRequiredScopes checks if scopes satisfy tool requirements
- pkg/scopes/fetcher.go: FetchTokenScopes gets scopes via HTTP HEAD to GitHub API
- pkg/github/scope_filter.go: CreateScopeFilter creates inventory.ToolFilter
Integration:
- Add --filter-by-scope flag to stdio command (disabled by default)
- When enabled, fetches token scopes on startup
- Tools requiring unavailable scopes are hidden from tool list
- Gracefully continues without filtering if scope fetch fails (logs warning)
This allows the OSS server to have similar scope-based tool visibility
as the remote server, and the filter logic can be reused by remote server.
Map iteration in Go is non-deterministic, which causes doc generation
to produce different output on each run. Sort the scope slices in:
- ScopeSet.ToSlice()
- ScopeSet.ToStringSlice()
- ExpandScopes()
public_repo is implicit - the GitHub API handles the distinction between
public and private repos. Using repo as the required scope is more
consistent with our enforcement model:
- PATs: tools visible if token has repo scope
- OAuth: scope challenge requests repo scope
- Add ScopeHierarchy map defining parent-child scope relationships
- Add ExpandScopes() function to derive accepted scopes from required scopes
- Update NewTool/NewToolFromHandler to take []scopes.Scope and auto-derive AcceptedScopes
- Add new scope constants: NoScope, User, ReadUser, UserEmail, ReadPackages, WritePackages
- Update all tool files to use new signature with typed scopes
- Add comprehensive tests for ExpandScopes
The scope hierarchy allows automatic derivation of accepted scopes:
- repo → public_repo, security_events
- admin:org → write:org → read:org
- project → read:project
- write:packages → read:packages
- user → read:user, user:email
This enables the remote server to consume scope info directly from OSS tools.
- Replace NewToolWithScopes with updated NewTool that includes scope parameters
- All tools now use the same constructor with explicit scope requirements
- Documentation only shows accepted scopes when they differ from required
- Removed NewToolWithScopes and NewToolFromHandlerWithScopes helper functions
Co-authored-by: SamMorrowDrums <4811358+SamMorrowDrums@users.noreply.github.com>
- Updated all remaining tools with OAuth scope information
- Added scope documentation generation to generate-docs command
- Documentation now shows Required and Accepted OAuth scopes for each tool
- All 100+ tools now have scope information defined
- Tests pass, linter passes, documentation generated successfully
Co-authored-by: SamMorrowDrums <4811358+SamMorrowDrums@users.noreply.github.com>
When multiple tools share the same name but have different feature flags
(like GetJobLogs and ActionsGetJobLogs both named "get_job_logs"),
filterToolsByName was only returning the first match. This caused the
remote server to fail with "unknown tool" error when the first matching
tool was disabled by feature flags, even though another variant was enabled.
The fix modifies filterToolsByName to return ALL tools with matching names,
allowing the feature flag filtering in AvailableTools to select the correct
variant based on the enabled flags.
Fixes#1714
Signed-off-by: majiayu000 <1835304752@qq.com>
Change the parameter name in assign_copilot_to_issue tool from
'issueNumber' (camelCase) to 'issue_number' (snake_case) to match
the naming convention used by all other tools in the issues toolset.
This improves API consistency and makes the tool parameters more
predictable for users and AI models.
Fixes#1239
Signed-off-by: majiayu000 <1835304752@qq.com>
The CodeQL workflow requires security-events write permission and access
to internal GitHub registries/packs that aren't available in forks.
Adding a condition to only run on the main repository prevents workflow
failures in forked repositories.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
Replace string conversions with mcp.IconThemeLight and mcp.IconThemeDark
constants to match the SDK's typed IconTheme field. This fixes the CI build
errors where string literals were being used instead of the proper IconTheme type.
Co-authored-by: SamMorrowDrums <4811358+SamMorrowDrums@users.noreply.github.com>
- Use separate -m flags for multi-line git commit message
- Add proper indentation to template literal content to fix YAML parsing
Co-authored-by: SamMorrowDrums <4811358+SamMorrowDrums@users.noreply.github.com>
* fix: handle architecture-specific license differences
The licenses script now:
- Generates separate license reports per GOOS/GOARCH combination
- Groups identical reports together (comma-separated arch names)
- Adds a Table of Contents at the top of each platform file
- Handles cases where different architectures have different dependencies
(e.g., x/sys/unix vs x/sys/windows, mousetrap on Windows only)
This addresses the issue discovered in cli/cli where some deps changed
which changed the mod graph for different GOARCH and affected the
exported licenses because go-licenses tries to find common ancestors.
* fix: make license script portable and deterministic
Address review feedback:
- Remove bash 4.0+ associative array requirement for macOS compatibility
- Add cross-platform hash function (md5sum on Linux, md5 on macOS)
- Ensure deterministic iteration order using sorted groups file
- Add better error handling for failed go-licenses commands
- Fix grammar: 'architecture(s)' -> 'architectures'
- Add documentation for third-party/ being a union of all architectures
- Use file-based state instead of associative arrays for portability
* fix: update licenses-check to use new architecture-aware format
- Check now regenerates using ./script/licenses and compares
- Add GOROOT/PATH setup in CI to fix go-licenses module info errors
- Check both license files AND third-party directory for changes
- See: https://github.com/google/go-licenses/issues/244
* fix: use LC_ALL=C for consistent sorting across systems
The sort command uses locale-specific ordering which can differ between
systems. Use LC_ALL=C to ensure consistent ordering in CI and locally.
* feat: auto-fix license files on PRs and improve CI reliability
Changes:
- Pin go-licenses version in CI for reproducibility (commit 5348b744)
- Add GOROOT/PATH setup for 'Package does not have module info' fix
- Update license-check.yml to auto-fix and push to PR branches
- Add CI=true env var to use pinned go-licenses version
- Add dependabot exclusion from auto-fix workflow
- Add code-scanning exclusion for third-party files
* feat: auto-close PRs that only needed license updates
After the bot pushes license fixes, check if the PR now only contains
license file changes. If so, close it automatically with a comment
explaining that the license updates are complete.
This prevents stale PRs from accumulating when someone creates a PR
just to fix licenses, or when all other changes were already merged
to the base branch.
* feat: auto-create/manage license fix PRs for failing PRs
Creates stacked PRs to fix license issues:
- Detects when a PR needs license updates
- Creates child PR: main <- PR:feature <- PR:license-fix
- Tracks PRs with metadata and hash of license changes
- Auto-closes if user fixes licenses manually
- Auto-closes and recreates if dependencies change
- Prevents multiple fix PRs for same base PR
Rules:
- Only targets PRs against main (not stacked PRs)
- Only runs on ready-for-review PRs (not drafts)
- Skips bots and forks
- Hash-based detection avoids unnecessary work
* fix: allow auto-fix workflow to run on dependabot PRs
Dependabot PRs frequently need license updates and can't be merged until
fixed. The auto-fix workflow helps by creating a child PR with the
license changes, making it easy to merge both together.
* fix: address Copilot review comments
- Remove dependabot exclusion (we want to support dependabot PRs)
- Comment indentation already fixed
- CI env var already set for reproducibility
* refactor: move base branch filter to on: block
Moved the 'targets main' check from job if: to workflow on.pull_request.branches.
This prevents the workflow from even triggering for PRs targeting other branches,
saving CI resources.
Draft check is implicit in the types list (opened + ready_for_review).
Fork check must stay in if: condition (can't be filtered in on: block).
* refactor: merge auto-fix into license-check workflow
Combines both workflows into one with two jobs:
1. license-check: Checks licenses, fails if needed, sets outputs
2. auto-create-fix-pr: Creates child PR if needed (only for non-forks)
Benefits:
- Single workflow file, easier to maintain
- Check fails (blocks merge) while still creating helpful fix PR
- Fork detection in first job, second job skips for forks
- Hash-based tracking prevents duplicate PRs
* refactor: simplify license-check to auto-commit approach
Much simpler workflow:
1. Always try to auto-commit fix directly to PR branch
2. If push fails (fork without permissions), comment once with instructions
3. Don't create child PRs - just fix in place or give instructions
4. Only comment if not already commented (prevent spam)
5. Always fail check if licenses need updating
Benefits:
- Much simpler - single job
- No child PR management complexity
- Clear UX: either fixed or instructed
- Works for all PRs (internal/fork/dependabot)
Sam Morrow