From a0a92d8d5a65ec2854b2979f09dfbc45a55286bf Mon Sep 17 00:00:00 2001
From: Jon Jensen <jonj@netflix.com>
Date: Fri, 28 Aug 2026 16:14:15 -0600
Subject: [PATCH] feat: report token permissions via env var

---
 src/Runner.Worker/JobExtension.cs    | 14 ++++++++++++++
 src/Test/L0/Worker/JobExtensionL0.cs | 20 ++++++++++++++++++++
 2 files changed, 34 insertions(+)

diff --git a/src/Runner.Worker/JobExtension.cs b/src/Runner.Worker/JobExtension.cs
index 1705f749f2f..c9dee132d28 100644
--- a/src/Runner.Worker/JobExtension.cs
+++ b/src/Runner.Worker/JobExtension.cs
@@ -20,6 +20,7 @@
 using GitHub.Runner.Worker.Dap;
 using GitHub.Services.Common;
 using Newtonsoft.Json;
+using Newtonsoft.Json.Serialization;
 using Pipelines = GitHub.DistributedTask.Pipelines;
 
 namespace GitHub.Runner.Worker
@@ -159,6 +160,19 @@ public async Task<List<IStep>> InitializeJob(IExecutionContext jobContext, Pipel
                                 context.Output($"{entry.Key}: {entry.Value}");
                             }
                             context.Output("##[endgroup]");
+
+                            try {
+                                // serialize permissions into an env var
+                                var contractResolver = new DefaultContractResolver() { NamingStrategy = new SnakeCaseNamingStrategy(true, false) };
+                                var permissionsJson = JsonConvert.SerializeObject(permissions, new JsonSerializerSettings() { ContractResolver = contractResolver, Formatting = Formatting.None });
+                                context.Global.EnvironmentVariables["GITHUB_TOKEN_PERMISSIONS"] = permissionsJson;
+                                context.SetEnvContext("GITHUB_TOKEN_PERMISSIONS", permissionsJson);
+                            }
+                            catch (Exception ex)
+                            {
+                                context.Output($"Fail to serialize GITHUB_TOKEN_PERMISSIONS: {ex.Message}");
+                                Trace.Error(ex);
+                            }
                         }
                     }
                     catch (Exception ex)
diff --git a/src/Test/L0/Worker/JobExtensionL0.cs b/src/Test/L0/Worker/JobExtensionL0.cs
index fa67aa33ad0..73ba0785db4 100644
--- a/src/Test/L0/Worker/JobExtensionL0.cs
+++ b/src/Test/L0/Worker/JobExtensionL0.cs
@@ -1090,6 +1090,26 @@ public async Task DebuggerClientConnectionTimeoutIsNotAnInfrastructureFailure()
             }
         }
 
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public async Task GITHUB_TOKEN_PERMISSIONS_IsSetInEnvContext()
+        {
+            using (TestHostContext hc = CreateTestContext())
+            {
+                var jobExtension = new JobExtension();
+                jobExtension.Initialize(hc);
+
+                _actionManager.Setup(x => x.PrepareActionsAsync(It.IsAny<IExecutionContext>(), It.IsAny<IEnumerable<Pipelines.JobStep>>(), It.IsAny<Guid>()))
+                              .Returns(Task.FromResult(new PrepareResult(new List<JobExtensionRunner>(), new Dictionary<Guid, IActionRunner>())));
+
+                _jobEc.Global.Variables.Set("system.github.token.permissions", "{\"Actions\": \"write\", \"Contents\": \"write\", \"PullRequests\": \"read\"}");
+                await jobExtension.InitializeJob(_jobEc, _message);
+
+                Assert.Equal("{\"actions\":\"write\",\"contents\":\"write\",\"pull_requests\":\"read\"}", _jobEc.Global.EnvironmentVariables["GITHUB_TOKEN_PERMISSIONS"]);
+            }
+        }
+
         private void EnableDebuggerOnMessage(TestHostContext hc)
         {
             _message.EnableDebugger = true;