feat: add gh-read GitHub app helper

test/scripts/gh-read.test.ts

@@ -0,0 +1,52 @@
+import { describe, expect, it } from "vitest";
+import {
+  buildReadPermissions,
+  normalizeRepo,
+  parsePermissionKeys,
+  parseRepoArg,
+} from "../../scripts/gh-read.js";
+
+describe("gh-read helpers", () => {
+  it("finds repo from gh args", () => {
+    expect(parseRepoArg(["pr", "view", "42", "-R", "openclaw/openclaw"])).toBe("openclaw/openclaw");
+    expect(parseRepoArg(["run", "list", "--repo=openclaw/docs"])).toBe("openclaw/docs");
+    expect(parseRepoArg(["pr", "view", "42"])).toBeNull();
+  });
+
+  it("normalizes repo strings from common git formats", () => {
+    expect(normalizeRepo("openclaw/openclaw")).toBe("openclaw/openclaw");
+    expect(normalizeRepo("github.com/openclaw/openclaw")).toBe("openclaw/openclaw");
+    expect(normalizeRepo("https://github.com/openclaw/openclaw.git")).toBe("openclaw/openclaw");
+    expect(normalizeRepo("git@github.com:openclaw/openclaw.git")).toBe("openclaw/openclaw");
+    expect(normalizeRepo("invalid")).toBeNull();
+  });
+
+  it("builds a read-only permission subset from granted permissions", () => {
+    expect(
+      buildReadPermissions(
+        {
+          actions: "write",
+          issues: "read",
+          administration: "write",
+          metadata: "read",
+          statuses: null,
+        },
+        ["actions", "issues", "metadata", "statuses", "administration"],
+      ),
+    ).toEqual({
+      administration: "read",
+      actions: "read",
+      issues: "read",
+      metadata: "read",
+    });
+  });
+
+  it("parses permission key overrides", () => {
+    expect(parsePermissionKeys(undefined)).toContain("pull_requests");
+    expect(parsePermissionKeys("actions, contents ,issues")).toEqual([
+      "actions",
+      "contents",
+      "issues",
+    ]);
+  });
+});