ghscope

const (
	// CapCodeRead is a read of a repository's contents, commits, branches,
	// releases and pull requests, and a clone or fetch.
	CapCodeRead Capability = "code_read"
	// CapCodeWrite is a git push. The REST routes that change content or refs
	// are not this capability: they are CapRepoContentWriteREST, refused.
	CapCodeWrite Capability = "code_write"
	// CapWorkflowsWrite is a push that changes a workflow file under
	// .github/workflows. GitHub refuses such a push from a token without its
	// separate workflows permission, so it is its own capability, and it means
	// nothing without CapCodeWrite beside it. The classifier cannot see which
	// files a push touches; GitHub's token check is what tells them apart.
	CapWorkflowsWrite Capability = "workflows_write"
	// CapPR is opening, updating and reviewing a pull request. Merging one,
	// or updating its branch, writes the repository and is
	// CapRepoContentWriteREST.
	CapPR Capability = "pr"
	// CapIssuesRead is a read of issues, their comments, labels and milestones.
	CapIssuesRead Capability = "issues_read"
	// CapIssuesWrite is creating and changing issues, comments, labels and
	// milestones. A pull request's conversation comment is an issue comment
	// on GitHub, so it is this capability, not CapPR.
	CapIssuesWrite Capability = "issues_write"
	// CapActionsRead is a read of workflows, runs, jobs, logs, artifacts and
	// caches.
	CapActionsRead Capability = "actions_read"
	// CapActionsExecute is dispatching, re-running or cancelling a workflow run.
	CapActionsExecute Capability = "actions_execute"
	// CapActionsAdmin is enabling or disabling a workflow, approving a held
	// run, and deleting runs, logs, artifacts and caches. GitHub serves it
	// from the same permission as CapActionsExecute; only the classifier
	// tells them apart.
	CapActionsAdmin Capability = "actions_admin"
	// CapPackagesRead is a read of the packages an organisation or account
	// owns.
	CapPackagesRead Capability = "packages_read"
	// CapPackagesWrite is deleting or restoring a package or one of its versions.
	CapPackagesWrite Capability = "packages_write"
	// CapRepoAdmin is changing or deleting a repository, its collaborators,
	// rulesets, branch protection and Actions settings, and creating one in an
	// organisation.
	CapRepoAdmin Capability = "repo_admin"
	// CapOrgRead is a read of an organisation's profile, members, teams and
	// repository list.
	CapOrgRead Capability = "org_read"
	// CapOrgAdmin is changing an organisation's settings, members, teams and
	// invitations.
	CapOrgAdmin Capability = "org_admin"
	// CapIdentity is reading the signed-in person's own profile (GET /user) —
	// what most tools call first to learn who they are. Not in ProfileDefault.
	CapIdentity Capability = "identity"
)

const (
	// CapDeniedTokens is every door onto a second credential: app and
	// installation tokens, OAuth authorizations, deploy keys, and the
	// registration tokens of self-hosted runners. A lane that can obtain one
	// is a lane that can leave the lane.
	CapDeniedTokens Capability = "denied_tokens"
	// CapDeniedHooks is repository and organisation webhooks: forwarding
	// events to a caller-chosen address is exfiltration with a webhook's
	// paperwork.
	CapDeniedHooks Capability = "denied_hooks"
	// CapDeniedSecrets is Actions, Dependabot, Codespaces and environment
	// secrets, and private registry credentials. GitHub serves them under
	// permissions of their own (secrets, organization_secrets, …), which
	// PermissionsFor never asks for.
	CapDeniedSecrets Capability = "denied_secrets"
	// CapDeniedAccount is everything that spans the signed-in person's whole
	// reach rather than this run's repositories: everything under /user but
	// the profile itself, the numeric /repositories aliases, notifications
	// and gists.
	CapDeniedAccount Capability = "denied_account"
	// CapDeniedSearch is the search API: a search runs across everything the
	// token can see, and its query, not its path, says where.
	CapDeniedSearch Capability = "denied_search"
	// CapDeniedGraphQL is the GraphQL endpoint — a single door onto every
	// other area, so no capability over it could mean anything.
	CapDeniedGraphQL Capability = "denied_graphql"
	// CapRepoContentWriteREST is a REST write to the repository's git data:
	// creating, moving or deleting a ref, creating a git object, writing or
	// deleting a file, merging (a branch, an upstream, a pull request),
	// updating a pull request's branch, renaming a branch, a release (which
	// creates or moves a tag), a source import, and an autofix commit. Such a
	// request reaches GitHub with no Wardyn check on which ref it moves or
	// what it writes — the run's branch confinement and push content rules
	// apply to git pushes, not to these routes — so it is refused, whatever
	// the run holds. Repository content reaches GitHub through git push.
	CapRepoContentWriteREST Capability = "repo_content_write_rest"
	// CapUnclassifiedWrite is a write this catalogue does not recognize. It is
	// the fail-closed answer, not a capability anyone can hold.
	CapUnclassifiedWrite Capability = "unclassified_write"
	// CapUnclassifiedRead is a read this catalogue does not recognize, refused
	// like its write twin rather than classified as a read GitHub might serve.
	CapUnclassifiedRead Capability = "unclassified_read"
)

const CapMetadata Capability = "metadata"