Add one-time manual diagnostic to list org fine-grained permissions

[eliorerz]

What

PR #173 shipped github_organization_role.runner_manager with permissions = ["manage_organization_runners"]. The apply that merge triggered failed:

Error: error creating organization role (osac-project/runner-manager): POST https://api.github.com/orgs/osac-project/organization-roles: 422 Invalid permission: `manage_organization_runners`. []

(Full failure, auto-filed per the existing failure-isolation mechanism: #174.) This confirms the app does have write access to custom org roles -- it's purely a wrong permission-string problem, not an installation-permission blocker. GitHub's docs only ever show the UI label ("Manage organization runners and runner groups"), never the identifier string, so guessing again isn't worth it when the live API can just answer directly.

Adds a manual-only, read-only workflow_dispatch step (list_org_fine_grained_permissions) that calls GET /orgs/{org}/organization-fine-grained-permissions using the same app token Terraform already uses, and writes the full permission list (plus a runner-filtered subset) to the job summary. No Terraform involved, no state touched. A no-op for the normal scheduled/push triggers.

Plan once merged

1. Dispatch this workflow once with list_org_fine_grained_permissions=true and exclude_addresses=github_organization_role.runner_manager,github_organization_role_team.runner_manager_wg_infra (the existing escape hatch from NO-ISSUE: Add failure isolation to Apply configuration workflow #169) in the same run, so the other 4 pending unrelated changes blocked since the Grant wg-infra org-level self-hosted runner management #173 apply failure aren't held up further while this gets sorted.
2. Read the real permission string from the job summary.
3. Fix organization.tf with the correct string in a fast-follow PR, and remove this diagnostic step in the same PR (one-time use, no ongoing utility once the string is known -- unlike exclude_addresses/state_rm_addresses/import_address, which are reusable escape hatches).
4. Verify live that the role and team binding actually get created, and close Apply configuration is failing #174.

NO-ISSUE

Summary by CodeRabbit

• New Features
  • Added an optional manual workflow setting to list organization fine-grained permissions.
  • Displays all available permissions, including runner-related entries, in the job summary when enabled.
  • Standard scheduled, push, and manual runs remain unchanged unless the setting is selected.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: osac-project/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 6b3bca57-6cb4-499a-8093-992eb83e2fa7

📥 Commits

Reviewing files that changed from the base of the PR and between 5bbdf49 and 5e7700d.

📒 Files selected for processing (1)

• .github/workflows/apply.yaml

🚧 Files skipped from review as they are similar to previous changes (1)

• .github/workflows/apply.yaml

---

Walkthrough

The workflow adds an optional manual input. When enabled, it lists organization fine-grained permissions, writes complete and runner-filtered results to the job summary, and skips Terraform changes.

Changes

Organization permission listing

Layer / File(s)	Summary
Manual permission query and Terraform gating .github/workflows/apply.yaml	The workflow accepts list_org_fine_grained_permissions, queries permissions with the generated GitHub App token, writes both listings to the job summary, and skips Terraform import, state removal, and apply steps when enabled.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• osac-project/github-config#162: Modifies the same workflow with manual inputs and conditional Terraform state behavior.

🚥 Pre-merge checks | ✅ 11

✅ Passed checks (11 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the manual diagnostic added to list organization fine-grained permissions.
Linked Issues check	✅ Passed	The read-only diagnostic directly supports identifying the permission causing the failed apply in issue #174.
Out of Scope Changes check	✅ Passed	The workflow changes remain within scope because they add only the requested manual diagnostic path.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
No-Hardcoded-Secrets	✅ Passed	The PR adds no hardcoded secrets: credentials use GitHub secret or token expressions, the client ID pre-existed, and scans found no key material, credential URLs, or long encoded literals.
No-Weak-Crypto	✅ Passed	The aggregate PR diff and repository searches found no MD5, SHA1, DES, RC4, 3DES, Blowfish, ECB, custom crypto, or non-constant-time secret/token comparison.
No-Injection-Vectors	✅ Passed	The changed workflow adds no SQL concatenation, eval/exec, pickle.loads, yaml.load, os.system, or dangerouslySetInnerHTML; jq only formats API JSON into the step summary.
Container-Privileges	✅ Passed	The PR changes only a GitHub Actions workflow. It adds no container or Kubernetes manifest and declares none of privileged, hostPID, hostNetwork, hostIPC, SYS_ADMIN, or allowPrivilegeEscalation.
No-Sensitive-Data-In-Logs	✅ Passed	The diagnostic writes only GitHub permission names and descriptions to the step summary; the app token stays in GITHUB_TOKEN, API JSON is redirected to /tmp, and AWS secrets are cleared.
Ai-Attribution	✅ Passed	The authored PR description and both PR commits contain no AI-tool mention, Assisted-by/Generated-by trailer, or Co-Authored-By trailer.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch list-org-permissions-diag

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/apply.yaml:
- Around line 80-92: Ensure the diagnostic mode controlled by
inputs.list_org_fine_grained_permissions remains read-only by gating every
mutating Terraform step, including TF Import, TF State Remove, and TF Apply,
with the condition that this input is not true; preserve normal execution when
the diagnostic input is false.
- Around line 82-85: Update the diagnostic step running the gh api command to
clear AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY in its step-level environment,
or remove those credentials from job scope and apply them only to the OpenTofu
steps. Keep GITHUB_TOKEN available for the organization-fine-grained-permissions
request.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository: osac-project/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: ec4b8925-5456-463c-9af1-deb4f18a5040

📥 Commits

Reviewing files that changed from the base of the PR and between 929b353 and 5bbdf49.

📒 Files selected for processing (1)

• .github/workflows/apply.yaml