Parse permissions (#133)

Resurrecting [this PR](https://gitea.com/gitea/act/pulls/73) as the original author has [lost motivation](https://github.com/go-gitea/gitea/pull/25664#issuecomment-2737099259) (though, to be clear - all credit belongs to them, all mistakes are mine and mine alone!)

Co-authored-by: Søren L. Hansen <sorenisanerd@gmail.com>
Reviewed-on: https://gitea.com/gitea/act/pulls/133
Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com>
Co-authored-by: Jack Jackson <scubbojj@gmail.com>
Co-committed-by: Jack Jackson <scubbojj@gmail.com>

pkg/jobparser/jobparser.go

@@ -64,6 +64,7 @@ func Parse(content []byte, options ...ParseOption) ([]*SingleWorkflow, error) {
 				RawOn:          workflow.RawOn,
 				Env:            workflow.Env,
 				Defaults:       workflow.Defaults,
+				RawPermissions: workflow.RawPermissions,
 			}
 			if err := swf.SetJob(id, job); err != nil {
 				return nil, fmt.Errorf("SetJob: %w", err)

pkg/jobparser/model.go

@@ -15,6 +15,7 @@ type SingleWorkflow struct {
 	Env            map[string]string `yaml:"env,omitempty"`
 	RawJobs        yaml.Node         `yaml:"jobs,omitempty"`
 	Defaults       Defaults          `yaml:"defaults,omitempty"`
+	RawPermissions yaml.Node         `yaml:"permissions,omitempty"`
 }
 
 func (w *SingleWorkflow) Job() (string, *Job) {
@@ -84,6 +85,7 @@ type Job struct {
 	With           map[string]interface{}    `yaml:"with,omitempty"`
 	RawSecrets     yaml.Node                 `yaml:"secrets,omitempty"`
 	RawConcurrency *model.RawConcurrency     `yaml:"concurrency,omitempty"`
+	RawPermissions yaml.Node                 `yaml:"permissions,omitempty"`
 }
 
 func (j *Job) Clone() *Job {
@@ -107,6 +109,7 @@ func (j *Job) Clone() *Job {
 		With:           j.With,
 		RawSecrets:     j.RawSecrets,
 		RawConcurrency: j.RawConcurrency,
+		RawPermissions: j.RawPermissions,
 	}
 }
 

pkg/model/workflow.go

@@ -23,8 +23,8 @@ type Workflow struct {
 	Env            map[string]string `yaml:"env"`
 	Jobs           map[string]*Job   `yaml:"jobs"`
 	Defaults       Defaults          `yaml:"defaults"`
-
-	RawConcurrency *RawConcurrency `yaml:"concurrency"` // For Gitea
+	RawConcurrency *RawConcurrency   `yaml:"concurrency"`
+	RawPermissions yaml.Node         `yaml:"permissions"`
 }
 
 // On events for the workflow
@@ -201,6 +201,7 @@ type Job struct {
 	Uses           string                    `yaml:"uses"`
 	With           map[string]interface{}    `yaml:"with"`
 	RawSecrets     yaml.Node                 `yaml:"secrets"`
+	RawPermissions yaml.Node                 `yaml:"permissions"`
 	Result         string
 }