Authorize same-repository caller token

Author: chubes4

.github/scripts/run-agent-task/build-codebox-task-request.mjs

@@ -87,8 +87,8 @@ const request = {
     requires_pr: booleanEnv("SUCCESS_REQUIRES_PR"),
   },
   access: {
+    caller_repo: requiredString("CALLER_REPO").toLowerCase(),
     access_token_repos: repositoryList("ACCESS_TOKEN_REPOS"),
-    require_access_token: booleanEnv("REQUIRE_ACCESS_TOKEN"),
     allowed_repos: parseJson("ALLOWED_REPOS", [], "array"),
   },
   limits: {
@@ -115,6 +115,9 @@ if (request.access.allowed_repos.some((repository) => typeof repository !== "str
 request.access.allowed_repos = [...new Set(request.access.allowed_repos.map((repository) => repository.toLowerCase()))]
 request.access.access_token_repos = [...new Set(request.access.access_token_repos.map((repository) => repository.toLowerCase()))]
 request.target_repo = request.target_repo.toLowerCase()
+if (!/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(request.access.caller_repo)) {
+  throw new Error("CALLER_REPO must be an OWNER/REPO value.")
+}
 if (!request.access.allowed_repos.includes(request.target_repo)) {
   throw new Error("ALLOWED_REPOS must explicitly include TARGET_REPO.")
 }

.github/scripts/run-agent-task/execute-native-agent-task.mjs

@@ -118,8 +118,11 @@ function accessFailure(request) {
   const allowed = Array.isArray(access.allowed_repos) ? access.allowed_repos : []
   const tokenRepos = Array.isArray(access.access_token_repos) ? access.access_token_repos : []
   const target = string(request.target_repo)
+  const caller = string(access.caller_repo)
   if (!allowed.includes(target) || !tokenRepos.includes(target)) return "Target repository is not explicitly authorized by allowed_repos and access_token_repos."
-  if (access.require_access_token === true && process.env.ACCESS_TOKEN_CONFIGURED !== "true") return "A configured ACCESS_TOKEN is required but unavailable."
+  if (!caller) return "Caller repository is required for publication authorization."
+  if (target !== caller && process.env.EXPLICIT_ACCESS_TOKEN_CONFIGURED !== "true") return "An explicit ACCESS_TOKEN is required for cross-repository publication."
+  if (!string(process.env.GITHUB_TOKEN)) return "No effective GitHub token is available for runner workspace tools."
   return ""
 }