[refactoring] Extract shared component: minimal read permissions block

[github-actions]

Skill: Common minimal permissions block

Description: A recurring permissions: block combining contents: read, issues: read, pull-requests: read (with variants adding actions: read, discussions: read, or copilot-requests: write) is duplicated verbatim across dozens of workflow frontmatter blocks.

Current usage

Across 285 workflows analyzed via /tmp/gh-aw/agent/workflow-index.json and direct frontmatter scan:

• 72 workflows use exactly contents: read + issues: read + pull-requests: read
• 24 workflows add actions: read
• 17 workflows add copilot-requests: write
• Several more variants with discussions: read

Example: .github/workflows/ab-testing-advisor.md permissions block.

Proposed shared component

shared/permissions-read-base.md (and optionally shared/permissions-read-actions.md, shared/permissions-read-copilot.md for the common variants) — imported via imports: to centralize the base read-only permission set.

Estimated impact

• 100+ workflows affected (permissions blocks appear in >100 files)
• ~4-6 lines saved per workflow => 400-600 lines total
• Maintenance benefit: a single place to update baseline least-privilege permissions when GitHub Actions permission scopes change, reducing risk of drift/inconsistency across workflows

Migration plan

1. Create shared/permissions-read-base.md with the common permissions: YAML block (contents/issues/pull-requests: read).
2. Create 1-2 variant files for the actions: read and copilot-requests: write additions, following the existing github-guard-policy.md pattern for merging frontmatter via imports.
3. Update a small pilot batch (5-10) of workflows to import the new component and verify gh aw compile produces identical resolved permissions.
4. Roll out across remaining matching workflows in follow-up PRs, in batches, running make recompile after each batch.

Example usage

imports:
  - shared/permissions-read-base.md

Priority: High (70+ workflows, low extraction complexity — pure YAML merge, no logic).

Generated by 🔍 Workflow Skill Extractor · auto · 60.3 AIC · ⌖ 3.43 AIC · ⊞ 7K · ◷

• expires on Aug 14, 2026, 8:26 PM UTC-08:00

[github-actions]

🍪 Issue Monster selected this for Copilot

I've identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

🍪 Om nom nom by Issue Monster · gpt54 · 2.02 AIC · ⌖ 4.24 AIC · ⊞ 12.8K · ◷

[github-actions]

This issue was automatically closed because it expired on 2026-08-15T04:26:50.471Z.

Closed by Workflow