fix: use actions_variables instead of variables for GitHub API key

[rh-hemartin]

Summary

• Fix JSON tag in AppPermissions.Variables from "variables" to "actions_variables" to match GitHub's API field name
• Fix fullsend role in mint rolePermissions to use "actions_variables" key so minted tokens actually receive the permission

Closes #997
Related: #996

How to verify

Check the app's permissions as GitHub returns them:

gh api apps/fullsend-fullsend --jq '.permissions'

The key for repo variables is actions_variables, not variables.

Test plan

• go vet passes on both modules
• go test ./internal/forge/github/ passes
• go test ./... passes in mint module
• make lint passes

🤖 Generated with Claude Code

[github-actions]

fullsend review is working on this — view logs

[github-actions]

Site preview

Preview: https://ff03a0ba-site.fullsend-ai.workers.dev

Commit: 49c91f9c14566cde19fce389f4e459907ebbbe72

[waynesun09]

Verified against the live API — gh api apps/fullsend-fullsend --jq '.permissions' confirms the key is actions_variables, not variables. GitHub docs don't list this key in the installation token schema, but the API uses it. Fix is correct and surgical.

[fullsend-ai-review]

Review: #998

Head SHA: 49c91f9
Timestamp: 2026-05-15T14:00:00Z
Outcome: approve

Summary

This is a correct, minimal bug fix. The two changes — updating the JSON struct tag on AppPermissions.Variables from "variables" to "actions_variables", and the corresponding key in the fullsend entry of rolePermissions — align the codebase with GitHub's actual API field name. The fix resolves two concrete bugs: false-positive stale-permission warnings from checkPermissions (which marshals AppPermissions to JSON for key comparison), and silent 403 errors when minted tokens request the unrecognized "variables" scope. The change is well-scoped to the linked issue #997 and does not introduce new capability.

Findings

Medium

• [correctness] internal/appsetup/appsetup_test.go:466-476 — TestSetup_CorrectPermissions_NoError uses a fake installation that is missing "actions_variables": "read" (and was already missing the pre-fix "variables": "read"). This is a pre-existing test bug — the test should have been catching the original mismatch but didn't appear in the PR author's test runs, likely because the test was already silently failing or not included in the targeted test commands. Adding "actions_variables": "read" to the fake installation's permissions map would make this test meaningful.
  Remediation: Add "actions_variables": "read" to the fake installation permissions in TestSetup_CorrectPermissions_NoError (line 466).

Low

• [correctness] No new unit tests were added for this fix, despite the triage agent in fix: use actions_variables instead of variables for GitHub API permission key #997 suggesting two targeted test cases (TestAppPermissions_ActionsVariablesKey and TestRolePermissions_FullsendActionsVariables). The fix is small and verifiable by inspection, but adding those tests would prevent regression.
  Remediation: Consider adding the tests suggested in the triage comment on fix: use actions_variables instead of variables for GitHub API permission key #997 to internal/forge/github/types_test.go and internal/mint/main_test.go.

Footer

Outcome: approve
This review applies to SHA 49c91f9c14566cde19fce389f4e459907ebbbe72. Any push to the PR head clears this review and requires a new evaluation.