Repository navigation
Align require_actor_write_permission cloud automation option naming with GitHub.com and ensure compliance with repository policies - #344444
Merged
Ben Villalobos (benvillalobos) merged 2 commits intoOct 27, 2026
Conversation
Match the read-access activity option's wording and polarity to GitHub.com, honor repository trigger restrictions, and explain the disabled state accessibly. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 0bc7a41e-9c6c-4cbd-b2a0-367630248e5b
Contributor
📬 CODENOTIFYThe following users are being notified based on files changed in this PR: Ulugbek Abdullaev (@ulugbekna)Matched files:
|
Tim Rogers (timrogers)
changed the title
require_actor_write_permission cloud automation option naming with GitHub.com and ensure compliance with repository policies
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Repository restrictions are lost when projecting targets for editable public-repository automations.
1 open issue
What changed in this PR
This PR aligns the Agents Window’s cloud automation activity option with GitHub.com and uses repository configuration to restrict activity from users without write access.
Changes:
- Renames the checkbox and inverts its mapping to
require_actor_write_permission. - Propagates repository configuration changes to the trigger editor.
- Adds disabled-state styling, explanatory hover text, accessibility help, and regression tests.
| File | Description |
|---|---|
src/vs/workbench/contrib/chat/common/automations/automationService.ts |
Adds read-access trigger policy to workspace targets. |
src/vs/sessions/contrib/sessions/browser/views/automationsAccessibility.ts |
Updates checkbox guidance and restriction explanations. |
src/vs/sessions/contrib/providers/copilotChatSessions/test/browser/githubCloudAutomationStore.test.ts |
Tests policy propagation during configuration refresh. |
src/vs/sessions/contrib/providers/copilotChatSessions/browser/githubCloudAutomationStore.ts |
Caches repository configuration and publishes trigger eligibility. |
src/vs/sessions/contrib/automations/test/browser/automationDialog.test.ts |
Covers checkbox polarity, restrictions, and reactive updates. |
src/vs/sessions/contrib/automations/browser/media/automationDialog.css |
Styles the disabled option and restriction indicator. |
src/vs/sessions/contrib/automations/browser/automationTriggerEditor.ts |
Implements inverted checkbox behavior and repository restrictions. |
src/vs/sessions/contrib/automations/browser/automationDialog.ts |
Connects workspace policy updates to the trigger editor. |
Review effort: Balanced
| this.targetEligibility.get(targetKey)?.set(canSelect ? { | ||
| workspace: URI.from({ scheme: GITHUB_REMOTE_FILE_SCHEME, authority: 'github', path: `/${repository.owner}/${repository.repo}/HEAD` }), | ||
| repositoryLabel: repositoryDisplayName(repository), | ||
| allowReadAccessTriggers: configuration.allow_read_access_triggers, |
Contributor
Author
There was a problem hiding this comment.
Fixed in 491db92. Both target projection paths now preserve cached allow_read_access_triggers independently of creation eligibility, so existing public-repository edits receive the restriction without making public repositories selectable for new automations. Added regression coverage for both refresh orderings, background configuration changes, and restricted public-repository edits. The provider regressions failed before the fix; all 326 focused tests now pass, along with targeted ESLint and the existing watcher type-check.
Ben Villalobos (benvillalobos)
previously approved these changes
Oct 26, 2026
Project cached repository trigger restrictions independently of creation eligibility, including background configuration refreshes. Cover both refresh ordering and restricted public-repository edits. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 0bc7a41e-9c6c-4cbd-b2a0-367630248e5b
Ben Villalobos (benvillalobos)
approved these changes
Oct 26, 2026
Dmitriy Vasyura (dmitrivMS)
approved these changes
Oct 26, 2026
Dileep Yavanmandha (dileepyavan)
approved these changes
Oct 26, 2026
Bhavya U (bhavyaus)
approved these changes
Oct 27, 2026
Ben Villalobos (benvillalobos)
merged commit Oct 27, 2026
abc2b20
into
microsoft:release/1.144
44 checks passed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Targets
release/1.144.require_actor_write_permission: false; unchecked sendstrue.allow_read_access_triggersfrom the repository configuration API. When explicitlyfalse, uncheck and disable the option and require actor write permission in the saved event configuration. Update the control when the selected repository or its cached configuration changes, without replacing filter controls or automatically broadening permissions when the restriction is lifted.Validation
npm run watchclient type-check completed with zero errors after the final changes.git diff --check.Manual verification
Live-server verification was not performed. Suggested checks:
require_actor_write_permissionhas the inverse value.allow_read_access_triggers: false, verify the option is unchecked and unavailable, the lock/reason and hover explain why, and saving retains the write-access requirement.