From f7008c9f4b5baa63f66e73081627a9bc398c91c9 Mon Sep 17 00:00:00 2001
From: Copilot <copilot@github.com>
Date: Mon, 23 Feb 2026 19:02:19 +0000
Subject: [PATCH] refactor: simplify permissions converter and sort pattern

- Remove unnecessary IIFE closure from convertStringToPermissionScope;
  since the 'all' case now returns '' directly, the surrounding func()()
  wrapper and the redundant 'key != all' post-check are no longer needed.
- Replace manual collect-keys/sort.Strings/iterate loop in
  compiler_activation_jobs.go with the idiomatic slices.Sorted(maps.Keys(...))
  one-liner; both packages were already imported.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 pkg/workflow/compiler_activation_jobs.go |  8 +--
 pkg/workflow/permissions.go              | 85 +++++++++++-------------
 2 files changed, 41 insertions(+), 52 deletions(-)

diff --git a/pkg/workflow/compiler_activation_jobs.go b/pkg/workflow/compiler_activation_jobs.go
index e2b3f7502a..44348fe411 100644
--- a/pkg/workflow/compiler_activation_jobs.go
+++ b/pkg/workflow/compiler_activation_jobs.go
@@ -6,7 +6,6 @@ import (
 	"fmt"
 	"maps"
 	"slices"
-	"sort"
 	"strconv"
 	"strings"
 
@@ -802,12 +801,7 @@ func (c *Compiler) buildMainJob(data *WorkflowData, activationJobCreated bool) (
 	// so the agent job gets them transitively through activation
 	// Custom jobs that depend on agent should run AFTER the agent job, not before it
 	if data.Jobs != nil {
-		jobNames := make([]string, 0, len(data.Jobs))
-		for jobName := range data.Jobs {
-			jobNames = append(jobNames, jobName)
-		}
-		sort.Strings(jobNames)
-		for _, jobName := range jobNames {
+		for _, jobName := range slices.Sorted(maps.Keys(data.Jobs)) {
 			// Skip jobs.pre-activation (or pre_activation) as it's handled specially
 			if jobName == string(constants.PreActivationJobName) || jobName == "pre-activation" {
 				continue
diff --git a/pkg/workflow/permissions.go b/pkg/workflow/permissions.go
index e2aaeb6597..1ad619987c 100644
--- a/pkg/workflow/permissions.go
+++ b/pkg/workflow/permissions.go
@@ -8,53 +8,48 @@ var permissionsLog = logger.New("workflow:permissions")
 
 // convertStringToPermissionScope converts a string key to a PermissionScope
 func convertStringToPermissionScope(key string) PermissionScope {
-	scope := func() PermissionScope {
-		switch key {
-		case "actions":
-			return PermissionActions
-		case "attestations":
-			return PermissionAttestations
-		case "checks":
-			return PermissionChecks
-		case "contents":
-			return PermissionContents
-		case "deployments":
-			return PermissionDeployments
-		case "discussions":
-			return PermissionDiscussions
-		case "id-token":
-			return PermissionIdToken
-		case "issues":
-			return PermissionIssues
-		case "metadata":
-			return PermissionMetadata
-		case "models":
-			return PermissionModels
-		case "packages":
-			return PermissionPackages
-		case "pages":
-			return PermissionPages
-		case "pull-requests":
-			return PermissionPullRequests
-		case "repository-projects":
-			return PermissionRepositoryProj
-		case "organization-projects":
-			return PermissionOrganizationProj
-		case "security-events":
-			return PermissionSecurityEvents
-		case "statuses":
-			return PermissionStatuses
-		case "all":
-			// "all" is a meta-key handled at the parser level; it is not a real scope
-			return ""
-		default:
-			return ""
-		}
-	}()
-	if scope == "" && key != "all" {
+	switch key {
+	case "actions":
+		return PermissionActions
+	case "attestations":
+		return PermissionAttestations
+	case "checks":
+		return PermissionChecks
+	case "contents":
+		return PermissionContents
+	case "deployments":
+		return PermissionDeployments
+	case "discussions":
+		return PermissionDiscussions
+	case "id-token":
+		return PermissionIdToken
+	case "issues":
+		return PermissionIssues
+	case "metadata":
+		return PermissionMetadata
+	case "models":
+		return PermissionModels
+	case "packages":
+		return PermissionPackages
+	case "pages":
+		return PermissionPages
+	case "pull-requests":
+		return PermissionPullRequests
+	case "repository-projects":
+		return PermissionRepositoryProj
+	case "organization-projects":
+		return PermissionOrganizationProj
+	case "security-events":
+		return PermissionSecurityEvents
+	case "statuses":
+		return PermissionStatuses
+	case "all":
+		// "all" is a meta-key handled at the parser level; it is not a real scope
+		return ""
+	default:
 		permissionsLog.Printf("Unknown permission scope key: %s", key)
+		return ""
 	}
-	return scope
 }
 
 // PermissionLevel represents the level of access (read, write, none)