Add missing permission scopes to schema and handle all meta-key in scope converter

pkg/parser/schema_test.go

@@ -744,7 +744,7 @@ func TestValidateMainWorkflowFrontmatterWithSchema(t *testing.T) {
 			errContains: "additional properties 'invalid_prop' not allowed",
 		},
 		{
-			name: "invalid permissions with unsupported repository-projects property",
+			name: "valid permissions with repository-projects property",
 			frontmatter: map[string]any{
 				"on": "push",
 				"permissions": map[string]any{
@@ -756,7 +756,18 @@ func TestValidateMainWorkflowFrontmatterWithSchema(t *testing.T) {
 					"repository-projects": "none",
 				},
 			},
-			wantErr: true,
+			wantErr: false,
+		},
+		{
+			name: "valid permissions with organization-projects property",
+			frontmatter: map[string]any{
+				"on": "push",
+				"permissions": map[string]any{
+					"contents":              "read",
+					"organization-projects": "write",
+				},
+			},
+			wantErr: false,
 		},
 		{
 			name: "valid claude engine with network permissions",

pkg/parser/schemas/main_workflow_schema.json

@@ -1582,6 +1582,16 @@
               "enum": ["read", "write", "none"],
               "description": "Permission level for pull requests (read/write/none). Controls access to create, edit, review, and manage pull requests."
             },
+            "repository-projects": {
+              "type": "string",
+              "enum": ["read", "write", "none"],
+              "description": "Permission level for repository projects (read/write/none). Controls access to manage repository-level GitHub Projects boards."
+            },
+            "organization-projects": {
+              "type": "string",
+              "enum": ["read", "write", "none"],
+              "description": "Permission level for organization projects (read/write/none). Controls access to manage organization-level GitHub Projects boards."
+            },
             "security-events": {
               "type": "string",
               "enum": ["read", "write", "none"],

pkg/workflow/permissions.go

@@ -44,11 +44,14 @@ func convertStringToPermissionScope(key string) PermissionScope {
 			return PermissionSecurityEvents
 		case "statuses":
 			return PermissionStatuses
+		case "all":
+			// "all" is a meta-key handled at the parser level; it is not a real scope
+			return ""
 		default:
 			return ""
 		}
 	}()
-	if scope == "" {
+	if scope == "" && key != "all" {
 		permissionsLog.Printf("Unknown permission scope key: %s", key)
 	}
 	return scope