@intentius/chant-lexicon-forgejo 0.106.1 → 0.106.3

package/README.md

@@ -33,9 +33,11 @@ On build, the Forgejo dialect:
 
 - **Drops keys Forgejo ignores** — `continue-on-error` is silently ignored by
   the Forgejo runner, so it is removed from the output and reported as a build
-  warning (emitting it is misleading). `permissions` is kept, so a job can
-  declare `id-token: write` to request an OIDC token; a Forgejo version that
-  does not honour it ignores the key.
+  warning (emitting it is misleading). `permissions` is dropped too, because
+  Forgejo reads none of its scopes and lists the key in the run page's
+  "Workflow warnings" box. The one exception is `id-token`: a job that assumes
+  a cloud role over OIDC keeps `id-token: write`, and nothing else from its
+  `permissions` block.
 - **Maps runner labels** — GitHub-hosted labels like `ubuntu-latest` have no
   fixed meaning on Forgejo. They are mapped to a default Forgejo label
   (`docker`), overridable per project. Unmapped labels pass through with a
@@ -77,7 +79,7 @@ fate across the edge:
 |---|---|
 | `translated` | carried across as-is |
 | `approximated` | carried with a close equivalent |
-| `needs-review` | confirm/adjust on Forgejo (`permissions`, unresolved `uses:`, unmapped runner label) |
+| `needs-review` | confirm/adjust on Forgejo (`permissions`, which the runner does not enforce, unresolved `uses:`, unmapped runner label) |
 | `lost` | the Forgejo runner ignores it (`continue-on-error`) |
 
 The same view is available to agents as the `forgejo:compare` MCP tool, which

package/dist/components/generate-op-pipeline.d.ts

@@ -10,8 +10,8 @@
  * before emitting.
  *
  * One difference from the component generator: Forgejo Actions ignores
- * `permissions:` entirely (the dialect drops it wherever it appears, see
- * ../dialect.ts's `DROPPED_KEYS`), so this omits the section outright rather
+ * the workflow-level `permissions:` section (the dialect drops every scope
+ * but `id-token`, see ../dialect.ts), so this omits the section outright rather
  * than emitting a control the runner can't act on. The token a finding-mode
  * needs still rides the trigger step's `env:` (`GH_TOKEN`/`GITHUB_TOKEN`,
  * built by github's generator); actual write access on Forgejo is a property

package/dist/components/generate-pipeline.d.ts

@@ -16,9 +16,8 @@
  *    (default `docker`, the label a fresh `act_runner` exposes);
  *  - `uses:` refs (`actions/checkout@v4`, `actions/upload-artifact@v4`, …)
  *    rewritten to a Forgejo-resolvable form;
- *  - keys the Forgejo runner ignores (`permissions`, `continue-on-error`)
- *    dropped — the github generator emits none today, but the transform keeps
- *    the two dialects in lock-step if that changes.
+ *  - keys the Forgejo runner ignores (`continue-on-error`, and `permissions` bar `id-token`)
+ *    dropped (`permissions` keeps only `id-token`, which OIDC needs).
  *
  * The output path convention is `.forgejo/workflows/` (vs github's
  * `.github/workflows/`), set by the caller's `-o` flag — this module emits the

package/dist/components/generate-pipeline.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generate-pipeline.d.ts","sourceRoot":"","sources":["../../src/components/generate-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAOH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,KAAK,EACV,wBAAwB,EACxB,uBAAuB,EACxB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAA2B,KAAK,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAOjF;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,UAAU,EAAE,eAAe,EAAE,EAC7B,OAAO,GAAE,wBAA6B,EACtC,cAAc,GAAE,qBAA0B,GACzC,uBAAuB,CAsBzB"}
+{"version":3,"file":"generate-pipeline.d.ts","sourceRoot":"","sources":["../../src/components/generate-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAOH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,KAAK,EACV,wBAAwB,EACxB,uBAAuB,EACxB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAA2B,KAAK,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAOjF;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,UAAU,EAAE,eAAe,EAAE,EAC7B,OAAO,GAAE,wBAA6B,EACtC,cAAc,GAAE,qBAA0B,GACzC,uBAAuB,CAsBzB"}

package/dist/dialect.d.ts

@@ -7,10 +7,13 @@
  * a pre-pass over the resolved entity graph before the github serializer runs:
  *
  *  1. `continue-on-error` is silently ignored by the Forgejo runner — we drop
- *     it from the output and warn per occurrence. `permissions` is kept: a
- *     Forgejo version that honours it (15 and later may) needs `id-token: write`
- *     on a job to request an OIDC token, and an older runner ignores the key.
- *     There is no version setting in the dialect, so the key always passes.
+ *     it from the output and warn per occurrence. `permissions` is reduced to
+ *     the one scope a Forgejo job can still use: `id-token`, which a job that
+ *     assumes a cloud role over OIDC needs (#3500). Every other scope
+ *     (`contents`, `pull-requests`, ...) is dropped without a warning, since
+ *     Forgejo reads none of them and flags the key in the run page's
+ *     "Workflow warnings" box. A `permissions` block with no `id-token` goes
+ *     away whole; one with it keeps only that line.
  *  2. GitHub-hosted runner labels (`ubuntu-latest`, …) have no fixed meaning on
  *     Forgejo — we map them to a default Forgejo label, overridable per project.
  *  3. Anything we can't place (an unmapped runner label) passes through with a

package/dist/dialect.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dialect.d.ts","sourceRoot":"","sources":["../src/dialect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAMH,OAAO,EAAsC,KAAK,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAgBlG;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAKxD,CAAC;AAEF,MAAM,WAAW,qBAAqB;IACpC,mFAAmF;IACnF,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,uEAAuE;IACvE,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,oBAAoB;IACnC,sEAAsE;IACtE,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAClC,iEAAiE;IACjE,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAmFD,MAAM,WAAW,qBAAqB;IACpC,qEAAqE;IACrE,KAAK,EAAE,OAAO,CAAC;IACf,8EAA8E;IAC9E,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,OAAO,EACZ,OAAO,GAAE,qBAA0B,GAClC,qBAAqB,CAKvB;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,EACjC,OAAO,GAAE,qBAA0B,GAClC,oBAAoB,CAWtB"}
+{"version":3,"file":"dialect.d.ts","sourceRoot":"","sources":["../src/dialect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAMH,OAAO,EAAsC,KAAK,UAAU,EAAE,MAAM,6BAA6B,CAAC;AA4ClG;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAKxD,CAAC;AAEF,MAAM,WAAW,qBAAqB;IACpC,mFAAmF;IACnF,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,uEAAuE;IACvE,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,oBAAoB;IACnC,sEAAsE;IACtE,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAClC,iEAAiE;IACjE,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAwFD,MAAM,WAAW,qBAAqB;IACpC,qEAAqE;IACrE,KAAK,EAAE,OAAO,CAAC;IACf,8EAA8E;IAC9E,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,OAAO,EACZ,OAAO,GAAE,qBAA0B,GAClC,qBAAqB,CAKvB;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,EACjC,OAAO,GAAE,qBAA0B,GAClC,oBAAoB,CAWtB"}

package/dist/integrity.json

@@ -1,13 +1,13 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "95e25f88b60f33d218f764470da8c67db7be1d3ea2b8281d886b2b292e9f643f",
+    "manifest.json": "b763478472c9951b4a9071719b721c2b70cde45b08d1d3402198dc3559462a93",
     "meta.json": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
     "types/index.d.ts": "66204549b2a864ab5489e3f02c1878e73ab4b3c9d938cfb480b66f71543a43de",
     "rules/delegate-to-github.ts": "1060cda40f4b73d6cca3ba3fa13b80b4886147d4034c88584c2d80c5510dbe5e",
     "rules/wfj010.ts": "f32834f8b8d0a8dd2a8e19f456df7e44aa63084cce3022ccb13f58f4a9f4f75c",
     "rules/wfj011.ts": "fcb8bf6685d744af20ad804ce929488257995c74b9a3353b2eacae3768d1c83e",
-    "skills/chant-forgejo.md": "a1a560429db736c187e0b34cf8dd9efc6ad771afefcbf6f802d160d3d5274257"
+    "skills/chant-forgejo.md": "f28d7fb69fb1cfd992496ef41fda0ea5ccd54a29b84ea1c501a44f6a3992c4d5"
   },
-  "composite": "2730d8d463e46849a79a58bc89e6be14149429b95c72faf413139f6ef9b751a4"
+  "composite": "17bd17ce87e6eb4c34d0b217d0f93a455a39442a89c38166e6042afbe02c5f96"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "forgejo",
-  "version": "0.106.1",
+  "version": "0.106.3",
   "chantVersion": ">=0.1.0",
   "namespace": "Forgejo",
   "intrinsics": [],

package/dist/migrate/from-github/security.d.ts

@@ -4,8 +4,8 @@
  * github → forgejo YAML is near-identical, so the migration itself is thin. The
  * differentiated value is the **compare**: classifying what survives the move
  * and what Forgejo silently drops. Most properties translate verbatim; the
- * useful findings are the keys the Forgejo runner ignores (`permissions`,
- * `continue-on-error` → `lost`) plus refs/labels that need attention
+ * useful findings are the keys the Forgejo runner ignores (`permissions` →
+ * `needs-review`, `continue-on-error` → `lost`) plus refs/labels that need attention
  * (unresolved `uses:`, unmapped runner labels → `needs-review`).
  *
  * Mirrors the gitlab lexicon's fate model (translated / approximated /

package/dist/skills/chant-forgejo.md

@@ -38,8 +38,9 @@ chant build src -o .forgejo/workflows/ci.yml
 
 ## What the dialect does on build
 
-- **Drops keys the Forgejo runner ignores** — `permissions` and
-  `continue-on-error` are removed (each emits a build warning).
+- **Drops keys the Forgejo runner ignores** — `continue-on-error` is removed
+  with a build warning. `permissions` is removed silently, except `id-token`,
+  which stays for OIDC.
 - **Maps runner labels** — `ubuntu-latest` → `docker` by default; override via
   `forgejo.runnerLabels` in `chant.config.ts`. Unmapped labels warn.
 - **Resolves `uses:` refs** — common `actions/*` rewrite under
@@ -53,7 +54,7 @@ chant migrate .github/workflows/ci.yml --to forgejo -o .forgejo/workflows/ci.yml
 ```
 
 `--validate` prints a **Security posture** report: what survives the move and
-what Forgejo silently drops (`permissions`/`continue-on-error` → lost,
+what Forgejo silently drops (`continue-on-error` → lost, `permissions` → needs-review,
 unresolved `uses:` / unmapped runner labels → needs-review). The same view is
 the `forgejo:compare` MCP tool.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-forgejo",
-  "version": "0.106.1",
+  "version": "0.106.3",
   "description": "Forgejo / Codeberg / Gitea Actions lexicon for chant — a thin GitHub Actions dialect",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -54,8 +54,8 @@
   },
   "peerDependencies": {
     "zod": "^4.3.6",
-    "@intentius/chant": "^0.106.1",
-    "@intentius/chant-lexicon-github": "^0.106.1"
+    "@intentius/chant": "^0.106.3",
+    "@intentius/chant-lexicon-github": "^0.106.3"
   },
   "scripts": {
     "generate": "tsx src/codegen/generate-cli.ts",

package/src/components/__fixtures__/pr-loop.forgejo.golden.yml

@@ -16,10 +16,6 @@ jobs:
     if: github.event_name == 'pull_request'
     runs-on: docker
     container: node:22
-    permissions:
-      contents: read
-      pull-requests: write
-      statuses: write
     steps:
       - uses: https://code.forgejo.org/actions/checkout@v7
         with:
@@ -46,10 +42,6 @@ jobs:
     concurrency:
       group: chant-apply-prod
       cancel-in-progress: false
-    permissions:
-      contents: write
-      pull-requests: write
-      statuses: write
     steps:
       - uses: https://code.forgejo.org/actions/checkout@v7
         with:

package/src/components/generate-op-pipeline.ts

@@ -10,8 +10,8 @@
  * before emitting.
  *
  * One difference from the component generator: Forgejo Actions ignores
- * `permissions:` entirely (the dialect drops it wherever it appears, see
- * ../dialect.ts's `DROPPED_KEYS`), so this omits the section outright rather
+ * the workflow-level `permissions:` section (the dialect drops every scope
+ * but `id-token`, see ../dialect.ts), so this omits the section outright rather
  * than emitting a control the runner can't act on. The token a finding-mode
  * needs still rides the trigger step's `env:` (`GH_TOKEN`/`GITHUB_TOKEN`,
  * built by github's generator); actual write access on Forgejo is a property

package/src/components/generate-pipeline.member.test.ts

@@ -15,7 +15,7 @@ describe("generateForgejoPipeline for a workspace member", () => {
   test("working directory and name survive the dialect, and the triggers stay the plain pipeline's", () => {
     const member = { name: "api", dir: "services/api", file: ".forgejo/workflows/chant-api-staging.yml" };
     const doc = parseYAML(generateForgejoPipeline(components, { env: "staging", member }).yaml) as Record<string, unknown>;
-    expect(doc.name).toBe("chant-components-api-staging");
+    expect(doc.name).toBe("chant-components.api.staging");
     expect(Object.keys(doc.on as Record<string, unknown>)).toEqual(["workflow_dispatch"]);
     expect(doc.defaults).toEqual({ run: { "working-directory": "services/api" } });
   });

package/src/components/generate-pipeline.ts

@@ -16,9 +16,8 @@
  *    (default `docker`, the label a fresh `act_runner` exposes);
  *  - `uses:` refs (`actions/checkout@v4`, `actions/upload-artifact@v4`, …)
  *    rewritten to a Forgejo-resolvable form;
- *  - keys the Forgejo runner ignores (`permissions`, `continue-on-error`)
- *    dropped — the github generator emits none today, but the transform keeps
- *    the two dialects in lock-step if that changes.
+ *  - keys the Forgejo runner ignores (`continue-on-error`, and `permissions` bar `id-token`)
+ *    dropped (`permissions` keeps only `id-token`, which OIDC needs).
  *
  * The output path convention is `.forgejo/workflows/` (vs github's
  * `.github/workflows/`), set by the caller's `-o` flag — this module emits the

package/src/components/generate-pr-pipeline.test.ts

@@ -38,11 +38,11 @@ describe("the Forgejo pull-request workflow", () => {
     expect(result.yaml).toBe(readFileSync(GOLDEN, "utf-8"));
   });
 
-  test("its commands talk to Forgejo, on Forgejo's runner, with the job permissions kept", () => {
+  test("its commands talk to Forgejo, on Forgejo's runner, with the job permissions dropped", () => {
     expect(result.yaml).toContain("--forge forgejo");
     expect(result.yaml).not.toContain("--forge github");
     expect(result.yaml).toContain("runs-on: docker");
-    expect(result.yaml).toMatch(/^\s+permissions:/m);
+    expect(result.yaml).not.toMatch(/^\s*permissions:/m);
   });
 
   test("the apply keeps its resume record in the runner's cache, through the Forgejo mirror of actions/cache (#3543)", () => {

package/src/dialect.test.ts

@@ -31,16 +31,16 @@ function entityMap(...pairs: Array<[string, Declarable]>): Map<string, Declarabl
 }
 
 describe("applyForgejoDialect — dropped keys", () => {
-  test("keeps workflow-level permissions without warning", () => {
+  test("drops workflow-level permissions without warning", () => {
     const wf = new MockWorkflow({ name: "CI", permissions: { contents: "read" } });
     const { entities, warnings } = applyForgejoDialect(entityMap(["workflow", wf]));
     const props = (entities.get("workflow") as MockWorkflow).props;
-    expect(props.permissions).toEqual({ contents: "read" });
+    expect("permissions" in props).toBe(false);
     expect(props.name).toBe("CI");
     expect(warnings.filter((w) => w.includes("permissions"))).toHaveLength(0);
   });
 
-  test("keeps job permissions, so a job can request an OIDC token", () => {
+  test("keeps only id-token from job permissions, so a job can request an OIDC token", () => {
     const job = new MockJob({
       "runs-on": "ubuntu-latest",
       permissions: { "id-token": "write", contents: "read" },
@@ -48,11 +48,34 @@ describe("applyForgejoDialect — dropped keys", () => {
     });
     const { entities, warnings } = applyForgejoDialect(entityMap(["job", job]));
     const props = (entities.get("job") as MockJob).props;
-    expect(props.permissions).toEqual({ "id-token": "write", contents: "read" });
+    expect(props.permissions).toEqual({ "id-token": "write" });
     expect(props["runs-on"]).toBe("docker");
     expect(warnings.filter((w) => w.includes("permissions"))).toHaveLength(0);
   });
 
+  test("drops job permissions that carry no id-token, and the read-all shorthand", () => {
+    const job = new MockJob({
+      "runs-on": "ubuntu-latest",
+      permissions: { contents: "read", "pull-requests": "write" },
+      steps: [{ name: "a", run: "echo a" }],
+    });
+    const other = new MockJob({ "runs-on": "ubuntu-latest", permissions: "read-all" });
+    const { entities, warnings } = applyForgejoDialect(entityMap(["job", job], ["other", other]));
+    expect("permissions" in (entities.get("job") as MockJob).props).toBe(false);
+    expect("permissions" in (entities.get("other") as MockJob).props).toBe(false);
+    expect(warnings).toHaveLength(0);
+  });
+
+  test("leaves a step input named permissions alone", () => {
+    const job = new MockJob({
+      "runs-on": "ubuntu-latest",
+      steps: [{ uses: "some-org/custom-action@v1", with: { permissions: "everyone" } }],
+    });
+    const { entities } = applyForgejoDialect(entityMap(["job", job]));
+    const steps = (entities.get("job") as MockJob).props.steps as Array<{ with: Record<string, unknown> }>;
+    expect(steps[0].with.permissions).toBe("everyone");
+  });
+
   test("drops job and step continue-on-error, one warning each", () => {
     const job = new MockJob({
       "runs-on": "ubuntu-latest",

package/src/dialect.ts

@@ -7,10 +7,13 @@
  * a pre-pass over the resolved entity graph before the github serializer runs:
  *
  *  1. `continue-on-error` is silently ignored by the Forgejo runner — we drop
- *     it from the output and warn per occurrence. `permissions` is kept: a
- *     Forgejo version that honours it (15 and later may) needs `id-token: write`
- *     on a job to request an OIDC token, and an older runner ignores the key.
- *     There is no version setting in the dialect, so the key always passes.
+ *     it from the output and warn per occurrence. `permissions` is reduced to
+ *     the one scope a Forgejo job can still use: `id-token`, which a job that
+ *     assumes a cloud role over OIDC needs (#3500). Every other scope
+ *     (`contents`, `pull-requests`, ...) is dropped without a warning, since
+ *     Forgejo reads none of them and flags the key in the run page's
+ *     "Workflow warnings" box. A `permissions` block with no `id-token` goes
+ *     away whole; one with it keeps only that line.
  *  2. GitHub-hosted runner labels (`ubuntu-latest`, …) have no fixed meaning on
  *     Forgejo — we map them to a default Forgejo label, overridable per project.
  *  3. Anything we can't place (an unmapped runner label) passes through with a
@@ -28,12 +31,40 @@ import { isDeclarable, isResourceDeclarable, type Declarable } from "@intentius/
 import { resolveActionRef } from "./actions";
 
 /**
- * Keys the Forgejo runner ignores. `permissions` is not among them: see above. Emitting them is misleading (they look
+ * Keys the Forgejo runner ignores. Emitting them is misleading (they look
  * enforced but aren't), so the dialect drops them. Compared in kebab-case so
  * both `continueOnError` and `continue-on-error` spellings are caught.
+ * `permissions` is handled apart, by {@link reducePermissions}.
  */
 const DROPPED_KEYS = new Set(["continue-on-error"]);
 
+/** The one `permissions` scope kept: a job needs it to request an OIDC token. */
+const KEPT_PERMISSION = "id-token";
+
+const PERMISSION_LEVELS = new Set(["read", "write", "none"]);
+
+/**
+ * True for a GitHub `permissions` value: `read-all`/`write-all`, or a map of
+ * scope to `read`/`write`/`none`. Anything else (an action's `with: {
+ * permissions: ... }` input, say) is not one and passes through untouched.
+ */
+function isPermissionsValue(value: unknown): boolean {
+  if (typeof value === "string") return value === "read-all" || value === "write-all";
+  if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+  const entries = Object.values(value as Record<string, unknown>);
+  return entries.every((v) => typeof v === "string" && PERMISSION_LEVELS.has(v));
+}
+
+/**
+ * Reduce a `permissions` value to what Forgejo can use: the `id-token` scope,
+ * or `undefined` when there is none (the caller then omits the key).
+ */
+function reducePermissions(value: unknown): Record<string, unknown> | undefined {
+  if (value === null || typeof value !== "object") return undefined;
+  const scope = (value as Record<string, unknown>)[KEPT_PERMISSION];
+  return scope === undefined ? undefined : { [KEPT_PERMISSION]: scope };
+}
+
 /** Property key whose value is a runner-label selector. */
 const RUNS_ON_KEY = "runs-on";
 
@@ -117,6 +148,11 @@ function transformValue(value: unknown, ctx: TransformCtx): unknown {
       );
       continue;
     }
+    if (kebab === "permissions" && isPermissionsValue(v)) {
+      const kept = reducePermissions(v);
+      if (kept) result[key] = kept;
+      continue;
+    }
     if (kebab === RUNS_ON_KEY) {
       result[key] = remapRunsOn(v, ctx);
       continue;

package/src/migrate/from-github/security.ts

@@ -4,8 +4,8 @@
  * github → forgejo YAML is near-identical, so the migration itself is thin. The
  * differentiated value is the **compare**: classifying what survives the move
  * and what Forgejo silently drops. Most properties translate verbatim; the
- * useful findings are the keys the Forgejo runner ignores (`permissions`,
- * `continue-on-error` → `lost`) plus refs/labels that need attention
+ * useful findings are the keys the Forgejo runner ignores (`permissions` →
+ * `needs-review`, `continue-on-error` → `lost`) plus refs/labels that need attention
  * (unresolved `uses:`, unmapped runner labels → `needs-review`).
  *
  * Mirrors the gitlab lexicon's fate model (translated / approximated /
@@ -80,8 +80,8 @@ export function analyzeForgejoSecurity(
           sourceFile: file,
           category: "needs-review",
           rule: "MIG-FJ-PERMISSIONS",
-          note: `permissions: is kept, but only a Forgejo version that honours it enforces it (15 and later may). An older runner ignores it, so confirm the token scope in your Forgejo/runner and repository settings.`,
-          security: { property: "Least-privilege permissions", fate: "needs-review", severity: "warning", reestablish: "Forgejo runner/token settings on a version that ignores permissions" },
+          note: `permissions: is dropped, except id-token, which a job needs to request an OIDC token. The Forgejo runner does not enforce the scopes, so confirm the token scope in your Forgejo/runner and repository settings.`,
+          security: { property: "Least-privilege permissions", fate: "needs-review", severity: "warning", reestablish: "Forgejo runner/token settings" },
         });
         continue;
       }

package/src/migrate.test.ts

@@ -23,13 +23,31 @@ describe("github → forgejo transform", () => {
   test("emits forgejo YAML with the dialect applied", async () => {
     const { output } = await transform(GHA_WORKFLOW, { sourceFile: "ci.yml" });
     expect(output).toContain("runs-on: docker");
-    expect(output).toContain("permissions");
+    expect(output).not.toContain("permissions");
     expect(output).not.toContain("continue-on-error");
     expect(output).toContain("https://code.forgejo.org/actions/checkout@v4");
     // unmapped ref still present (passed through), surfaced in the compare
     expect(output).toContain("some-org/custom-action@v1");
   });
 
+  test("keeps id-token from a job's permissions, for OIDC", async () => {
+    const { output } = await transform(
+      `on: push
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      contents: read
+    steps:
+      - run: echo hi
+`,
+      { sourceFile: "deploy.yml" },
+    );
+    expect(output).toContain("id-token: write");
+    expect(output).not.toContain("contents: read");
+  });
+
   test("classifies property fates (provenance + posture)", async () => {
     const { provenance, securityPosture, diagnostics } = await transform(GHA_WORKFLOW, { sourceFile: "ci.yml" });
     const rules = provenance.map((r) => r.rule);

package/src/serializer.test.ts

@@ -47,9 +47,9 @@ describe("forgejoSerializer — github-style source roundtrip", () => {
     expect(primary).toContain("npm run build");
   });
 
-  test("keeps permissions, drops continue-on-error with a warning on each", () => {
+  test("drops permissions silently, drops continue-on-error with a warning on each", () => {
     const result = asResult(forgejoSerializer.serialize(buildSource()));
-    expect(result.primary).toContain("permissions");
+    expect(result.primary).not.toContain("permissions");
     expect(result.primary).not.toContain("continue-on-error");
     // job continue-on-error + step continue-on-error
     expect((result.warnings ?? []).filter((w) => w.includes("permissions"))).toHaveLength(0);
@@ -128,7 +128,7 @@ describe("forgejoSerializer — multi-workflow output", () => {
 // "@intentius/chant-lexicon-github"`); nothing forgejo-specific is written for
 // it. This is the functional check that inheritance actually holds, not just
 // that the type is importable: the dialect still drops the job's
-// `permissions` and remaps its runner label, and the sticky-comment step — a
+// `permissions` (but for `id-token`) and remaps its runner label, and the sticky-comment step — a
 // plain `gh api` script with no `uses:` at all — passes through the dialect
 // transform untouched, because the dialect only ever rewrites job-level
 // `permissions:`/`environment:`/action refs and never looks at step content.
@@ -162,8 +162,8 @@ describe("forgejoSerializer — inherits PrPlanReport from github (#1983)", () =
     const result = asResult(out);
     expect(result.primary).toContain("runs-on: docker");
     expect(result.primary).not.toContain("ubuntu-latest");
-    // The job carries `permissions`, which the dialect keeps.
-    expect(result.primary).toContain("permissions:");
+    // The job carries `permissions` with no `id-token`, which the dialect drops.
+    expect(result.primary).not.toContain("permissions:");
     expect((result.warnings ?? []).filter((w) => w.includes("permissions"))).toHaveLength(0);
     // The sticky-comment mechanism is a raw script, nothing to remap or drop.
     expect(result.primary).toContain("Post or update PR comment");

package/src/skills/chant-forgejo.md

@@ -38,8 +38,9 @@ chant build src -o .forgejo/workflows/ci.yml
 
 ## What the dialect does on build
 
-- **Drops keys the Forgejo runner ignores** — `permissions` and
-  `continue-on-error` are removed (each emits a build warning).
+- **Drops keys the Forgejo runner ignores** — `continue-on-error` is removed
+  with a build warning. `permissions` is removed silently, except `id-token`,
+  which stays for OIDC.
 - **Maps runner labels** — `ubuntu-latest` → `docker` by default; override via
   `forgejo.runnerLabels` in `chant.config.ts`. Unmapped labels warn.
 - **Resolves `uses:` refs** — common `actions/*` rewrite under
@@ -53,7 +54,7 @@ chant migrate .github/workflows/ci.yml --to forgejo -o .forgejo/workflows/ci.yml
 ```
 
 `--validate` prints a **Security posture** report: what survives the move and
-what Forgejo silently drops (`permissions`/`continue-on-error` → lost,
+what Forgejo silently drops (`continue-on-error` → lost, `permissions` → needs-review,
 unresolved `uses:` / unmapped runner labels → needs-review). The same view is
 the `forgejo:compare` MCP tool.