@theholocron/holocron-plugin-github 5.0.0-alpha.437 → 5.0.0-alpha.442

package/dist/index.mjs

@@ -2216,7 +2216,7 @@ const EXPECTED = {
 		secrets: "absent"
 	}),
 	HOLOCRON_ORG_TOKEN: everywhere({
-		"org-administration": "required",
+		administration: "required",
 		"org-members": "required",
 		"org-variables": "required",
 		"org-secrets": "absent"
@@ -2271,7 +2271,7 @@ function parseTokenArgs(args) {
 * Every permission the GitHub plugin's tokens are declared against, by the name the declaration uses, with one read
 * that needs it. A read proves the token can see the area, not that it can write to it: GitHub exposes no list of a
 * fine-grained token's permissions, so the write half of `read/write` is taken from the permission table in
-* `docs/src/content/docs/tokens.mdx`. On a public repository the `contents`, `actions`, `issues` and `pull-requests`
+* `docs/src/content/docs/tokens.mdx`. On a public repository the `contents`, `actions`, `issues`, `pull-requests` and `environments`
 * reads succeed for any token, so only the other permissions can prove a permission absent. Names with more than one
 * word are hyphenated, not underscored: `holocron probe docs tokens` strips `_` (Markdown emphasis) from a table cell
 * before it compares the id with the declaration.
@@ -2279,19 +2279,23 @@ function parseTokenArgs(args) {
 const PERMISSIONS = {
 	contents: {
 		label: "Contents",
-		path: "/repos/{r}/contents"
+		path: "/repos/{r}/contents",
+		publicRead: true
 	},
 	actions: {
 		label: "Actions",
-		path: "/repos/{r}/actions/runs?per_page=1"
+		path: "/repos/{r}/actions/runs?per_page=1",
+		publicRead: true
 	},
 	issues: {
 		label: "Issues",
-		path: "/repos/{r}/issues?per_page=1"
+		path: "/repos/{r}/issues?per_page=1",
+		publicRead: true
 	},
 	"pull-requests": {
 		label: "Pull requests",
-		path: "/repos/{r}/pulls?per_page=1"
+		path: "/repos/{r}/pulls?per_page=1",
+		publicRead: true
 	},
 	administration: {
 		label: "Administration",
@@ -2303,7 +2307,8 @@ const PERMISSIONS = {
 	},
 	environments: {
 		label: "Environments",
-		path: "/repos/{r}/environments?per_page=1"
+		path: "/repos/{r}/environments?per_page=1",
+		publicRead: true
 	},
 	"actions-variables": {
 		label: "Variables",
@@ -2317,10 +2322,6 @@ const PERMISSIONS = {
 		label: "Pages",
 		path: "/repos/{r}/pages"
 	},
-	"org-administration": {
-		label: "Organization: Administration",
-		path: "/orgs/{o}/actions/permissions"
-	},
 	"org-members": {
 		label: "Organization: Members",
 		path: "/orgs/{o}/members?per_page=1"
@@ -2384,7 +2385,7 @@ async function reach(ctx, token, permission) {
 * judges: a required permission the token lacks fails, and one the layer must not have fails when the token has it; a
 * permission that is rightly absent is a bare `ok`.
 */
-function rowFor({ label, outcome }, rule) {
+function rowFor({ label, permission, outcome }, rule) {
 	if (outcome.kind === "error") return {
 		status: "fail",
 		label,
@@ -2396,6 +2397,11 @@ function rowFor({ label, outcome }, rule) {
 		label,
 		detail: outcome.detail
 	};
+	if (rule === "absent" && has && PERMISSIONS[permission].publicRead) return {
+		status: "info",
+		label,
+		detail: `${outcome.detail}, which any token can on a public repository: not proof either way`
+	};
 	if (rule === "absent") return has ? {
 		status: "fail",
 		label,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@theholocron/holocron-plugin-github",
-  "version": "5.0.0-alpha.437",
+  "version": "5.0.0-alpha.442",
   "description": "Holocron plugin for GitHub. Implements source, ci, secrets, environments, and issues capabilities against the GitHub REST API.",
   "keywords": [
     "ci",
@@ -44,21 +44,21 @@
     "tsx": "4.23.15",
     "typescript": "^5.9.3",
     "vitest": "^5.1.0",
-    "@theholocron/cli": "5.0.0-alpha.437",
+    "@theholocron/cli": "5.0.0-alpha.442",
+    "@theholocron/eslint-config": "^8.9.0-alpha.17",
     "@theholocron/fs-utils": "^1.17.0-alpha.4",
     "@theholocron/github-client": "^1.58.0-alpha.32",
-    "@theholocron/http-client": "^1.58.0-alpha.32",
-    "@theholocron/eslint-config": "^8.9.0-alpha.17",
-    "@theholocron/tsconfig": "^8.9.0-alpha.17",
-    "@theholocron/tsdown-config": "^8.9.0-alpha.17",
+    "@theholocron/misc-utils": "^1.17.0-alpha.4",
     "@theholocron/vitest-config": "^8.9.0-alpha.17",
-    "@theholocron/misc-utils": "^1.17.0-alpha.4"
+    "@theholocron/tsdown-config": "^8.9.0-alpha.17",
+    "@theholocron/tsconfig": "^8.9.0-alpha.17",
+    "@theholocron/http-client": "^1.58.0-alpha.32"
   },
   "peerDependencies": {
     "@theholocron/fs-utils": "^1.16.0",
     "@theholocron/github-client": "^1.58.0",
     "@theholocron/misc-utils": "^1.16.0",
-    "@theholocron/cli": "5.0.0-alpha.437"
+    "@theholocron/cli": "5.0.0-alpha.442"
   },
   "engines": {
     "node": ">=22"