Sam Morrow
4ec3576d86
CodeQL / Analyze (go) (push) Has been cancelled
CodeQL / Analyze (actions) (push) Has been cancelled
CodeQL / Analyze (javascript) (push) Has been cancelled
Build and Test Go Project / build (macos-latest) (push) Has been cancelled
Build and Test Go Project / build (ubuntu-latest) (push) Has been cancelled
Build and Test Go Project / build (windows-latest) (push) Has been cancelled
Mirror the existing pkg/scopes subsystem with a new pkg/permissions package so this repo is the public source of truth for the fine-grained permission each MCP tool requires. - pkg/permissions: typed Permission/Level/Scope, Requirement combinators (Require/AllOf/AnyOf/And, SatisfiedBy, Permissions), and a generated catalog (catalog_generated.go) produced from the PUBLIC github/rest-api-description app-permissions schema via gen.go. - inventory.ServerTool gains RequiredPermissions + chainable WithPermissions; zero value means "no gate" (tool always shown). - pkg/github/permission_filter.go: inventory bridge helpers and a fail-open CreateToolPermissionFilter (dormant in OSS; no granted source). - Seed hand-authored requirements for a high-signal subset of tools. - generate-docs emits a "Required Permissions (fine-grained)" line and a generated table in new docs/permissions-filtering.md; README + server configuration link it. - New list-permissions CLI + script/list-permissions. Catalog data is exclusively public (names + levels as in the REST docs and the X-Accepted-GitHub-Permissions header); enterprise permissions excluded. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>