[bug-hunter] PR Review (Fork) example omits required permissions for reusable workflow #1819

#!/usr/bin/env python3
from __future__ import annotations

from pathlib import Path
import re
import sys

REPO = Path("/home/runner/work/ai-github-actions/ai-github-actions")
FORK_EXAMPLE = REPO / "gh-agent-workflows/pr-review-fork/example.yml"
PR_REVIEW_MD = REPO / ".github/workflows/gh-aw-pr-review.md"


def parse_permissions_block_from_yaml_text(text: str) -> dict[str, str]:
    lines = text.splitlines()
    permissions: dict[str, str] = {}
    in_permissions = False

    for line in lines:
        if not in_permissions:
            if re.match(r"^permissions:\\s*$", line):
                in_permissions = True
            continue

        if line.strip() == "" or line.lstrip().startswith("#"):
            continue

        if re.match(r"^[^\\s#].*", line):
            break

        m = re.match(r"^\\s{2}([A-Za-z0-9_-]+):\\s*([A-Za-z-]+)", line)
        if m:
            permissions[m.group(1)] = m.group(2)

    return permissions


def read_frontmatter(path: Path) -> str:
    text = path.read_text(encoding="utf-8")
    m = re.match(r"^---\\n(.*?)\\n---\\n", text, re.DOTALL)
    if not m:
        raise RuntimeError(f"Could not parse frontmatter from {path}")
    return m.group(1)


def main() -> int:
    caller_permissions = parse_permissions_block_from_yaml_text(
        FORK_EXAMPLE.read_text(encoding="utf-8")
    )
    callee_permissions = parse_permissions_block_from_yaml_text(read_frontmatter(PR_REVIEW_MD))

    required = {k: v for k, v in callee_permissions.items() if v != "none"}
    missing = {k: v for k, v in required.items() if k not in caller_permissions}

    print("caller permissions:", caller_permissions)
    print("callee required permissions:", required)
    print("missing in caller:", missing)

    if missing:
        return 1
    return 0


if __name__ == "__main__":
    sys.exit(main())