update some workflows to disable lockdown mode

Author: dsyme

.github/aw/actions-lock.json

@@ -5,6 +5,11 @@
       "version": "v4",
       "sha": "34e114876b0b11c390a56381ad16ebd13914f8d5"
     },
+    "actions/checkout@v5": {
+      "repo": "actions/checkout",
+      "version": "v5",
+      "sha": "93cb6efe18208431cddfb8368fd83d5badbf9bfd"
+    },
     "actions/github-script@v8": {
       "repo": "actions/github-script",
       "version": "v8",

workflows/contribution-guidelines-checker.md

@@ -24,6 +24,12 @@ safe-outputs:
 tools:
   github:
     toolsets: [default]
+    # If in a public repo, setting `lockdown: false` allows
+    # reading issues, pull requets and comments from 3rd-parties
+    # If in a private repo this has no particular effect.
+    #
+    # This is important for this workflow to be able to read contribution guidelines
+    lockdown: false
 
 timeout-minutes: 10
 ---

workflows/daily-plan.md

@@ -22,6 +22,10 @@ safe-outputs:
 tools:
   github:
     toolsets: [all]
+    # If in a public repo, setting `lockdown: false` allows
+    # reading issues, pull requets and comments from 3rd-parties
+    # If in a private repo this has no particular effect.
+    lockdown: false
   web-fetch:
 
 timeout-minutes: 15

workflows/daily-repo-status.md

@@ -18,6 +18,10 @@ network: defaults
 
 tools:
   github:
+    # If in a public repo, setting `lockdown: false` allows
+    # reading issues, pull requets and comments from 3rd-parties
+    # If in a private repo this has no particular effect.
+    lockdown: false
 
 safe-outputs:
   create-issue:

workflows/issue-triage.md

@@ -22,6 +22,12 @@ safe-outputs:
 
 tools:
   web-fetch:
+  github:
+    toolsets: [issues]
+    # If in a public repo, setting `lockdown: false` allows
+    # reading issues, pull requets and comments from 3rd-parties
+    # If in a private repo this has no particular effect.
+    lockdown: false    
 
 timeout-minutes: 10
 ---

workflows/plan.md

@@ -1,19 +1,32 @@
 ---
 name: Plan Command
 description: Generates project plans and task breakdowns when invoked with /plan command in issues or PRs
+
 on:
   slash_command:
     name: plan
     events: [issue_comment, discussion_comment]
+
 permissions:
   contents: read
   discussions: read
   issues: read
   pull-requests: read
+
 engine: copilot
+
 tools:
   github:
     toolsets: [default, discussions]
+    # If in a public repo, setting `lockdown: false` allows
+    # reading issues, pull requets and comments from 3rd-parties
+    # If in a private repo this has no particular effect.
+    #
+    # This allows the maintainer to use /plan in discussions and issues created
+    # by 3rd parties, and to read the content of those discussions and issues
+    # turning the content into actionable tasks.
+    lockdown: false
+
 safe-outputs:
   create-issue:
     title-prefix: "[task] "

workflows/repo-ask.md

@@ -21,6 +21,16 @@ safe-outputs:
 tools:
   web-fetch:
   bash: true
+  github:
+    toolsets: [default, discussions]
+    # If in a public repo, setting `lockdown: false` allows
+    # reading issues, pull requets and comments from 3rd-parties
+    # If in a private repo this has no particular effect.
+    #
+    # This allows the maintainer to use /repo-ask in discussions and issues created
+    # by 3rd parties, and to read the content of those discussions and issues
+    # turning the content into actionable tasks.
+    lockdown: false
 
 timeout-minutes: 20