Keep workflow declarations separate from live token access

Make the declaration review useful before drawing conclusions

A request to make permission declarations explicit is a concrete maintenance task. The Viper issue describes six jobs across three workflows; a local review can identify which jobs inherit a policy and which have their own mapping. It cannot prove the reporter's vulnerability claim, inspect a live token or make repository settings appear in a file that did not contain them.

T303 records one actual snapshot and its hash. That boundary is useful: an unknown default becomes a visible review item rather than a guessed grant, and a supplied default carries an unverified provenance marker. The output remains understandable when it is passed to a maintainer who knows the repository configuration.

Replacement is different from an accumulated list of grants

A workflow mapping and a job mapping are not two lists to union. In the checked fixture, deploy asks for id-token: write and does not inherit workflow contents: read. Its omitted contents is none. Empty uses {} and has an explicit all-none policy. A report that simply collects every permission word would lose that meaning.

Keep policy origin beside the selected policy. Also preserve global modes literally: scopes=null under read-all or write-all makes clear that the tool did not pretend to enumerate actual live access. A policy can be completely declared while runtime restrictions remain unknown.

An unresolved dependency deserves a row

Dropping a missing target or a matrix expression would make the graph look cleaner and the review less accurate. The complete export keeps all needs declarations and separates missing/expression issues from edges to exact existing IDs. It keeps each job/step use and original condition or matrix without executing them.

The six-job example contains a two-job cycle and a downstream dependent. Only cycleA/cycleB belong to that cycle. The downstream job still needs attention because it references an absent job and an unresolved expression. Different issues should remain distinguishable in the handoff.

• Keep original job mappings, including run text, beside the derived fields.
• Do not follow a local or remote action path to make a declaration report.
• Treat user-supplied defaults as context, not a verified repository setting.
• Use separate snapshots for separate workflows; do not infer cross-file runtime behavior.

A bounded preview can still deliver a complete review

A large workflow can produce more data than a narrow screen can show. The preview limits rows and cells; the downloaded JSON and CSV preserve all job records. Independent readback recomputes permission origins and every declaration/edge/use and checks every CSV row, including actual combined 1,000-job/10,000-edge/10,000-use sources.

Strict refusals are part of a reliable handoff. Unsupported collections, duplicate keys or cyclic aliases cannot become empty-looking success. Multiple YAML documents fail instead of silently ignoring later workflows. A source within 5MiB can still exceed the separate 10MiB download budget. On failure or actual cancellation, correct the source or rerun the same supported input; no partial success files are offered.