fix(#470): add workflows:write permission to coder GitHub App

[fullsend-ai-coder]

The coder agent's GitHub App lacked the workflows permission, causing pushes to be rejected whenever the agent modified files under .github/workflows/. GitHub requires the workflows: write permission for any app creating or updating workflow files.

Changes:

• Add Workflows: "write" to the coder role in AgentAppConfig
• Add test assertions: coder has workflows:write, triage and
  review do not
• Update ADR-0007 to document the relaxed permission boundary
  and note CODEOWNERS as the complementary safeguard

Note: existing GitHub App installations will need to accept the updated permissions.

Note: pre-commit could not run in sandbox (network error). Manual verification of pre-commit hooks is required.

---

Closes #470

Post-script verification

• Branch is not main/master (agent/470-add-coder-workflows-permission)
• Secret scan passed (gitleaks — 050c28fb6d099f335e2054871e8c65519c21d6c8..HEAD)
• Pre-commit hooks passed (authoritative run on runner)
• Tests ran inside sandbox

[github-actions]

fullsend review is working on this — view logs

[github-actions]

Site preview

Preview: https://30026012-site.fullsend-ai.workers.dev

Commit: d2488c3e700ca0f217acd20f400f93d7b25f6894

[fullsend-ai-review]

Review: #787

Head SHA: d2488c3
Timestamp: 2026-05-08T22:00:00Z
Outcome: approve

Summary

This PR correctly adds workflows: write to the coder GitHub App's permissions, fixing a class of failures where the coder agent's pushes were rejected by GitHub when the change set included .github/workflows/ files. The change is minimal and well-scoped: one permission addition in types.go, three test assertions covering the coder (positive) and triage/review (negative) cases, and an updated security note in ADR-0007 documenting the expanded attack surface with appropriate mitigations (repo-scoped installs, PEM isolation, source_repo allowlist, and CODEOWNERS enforcement). No correctness, security, or injection concerns were identified.

Findings

No findings.

Footer

Outcome: approve
This review applies to SHA d2488c3e700ca0f217acd20f400f93d7b25f6894. Any push to the PR head clears this review and requires a new evaluation.

[ralphbean]

Closing this PR — the code change is correct but premature.

During review, we analyzed the threat model in detail (see #470 for the full writeup). The short version:

• An outside attacker cannot introduce new workflow files that execute — GitHub's security model prevents this for fork PRs.
• But the coder agent pushes directly to branches with contents: write. Adding workflows: write means a prompt-injected agent could create a workflow with push triggers that runs immediately with repo secrets — before any review.
• The CODEOWNERS mitigation documented in the ADR update gates the merge, not the execution of push-triggered workflows on feature branches.
• However, this threat is fully mitigable at the repo configuration layer: environment protection rules, secret scoping to environments with required reviewers, read-only default GITHUB_TOKEN, etc.

The right sequence is: verify repo hardening first, then grant the permission. Filed #788 to track building that repo readiness assessment. Once repos pass the hardening checks, this PR's change can be re-applied safely.

Thanks to the code agent for a clean implementation — the code and tests are correct, we just need the surrounding guardrails first.