Summary

Reverts the regression introduced by PR #25508, which removed permission-discussions from the convertPermissionsToAppTokenFields() function.

Root Cause

PR #25508 was based on two incorrect assumptions about actions/create-github-app-token:

1. "Unsupported inputs are silently ignored"

Wrong. The action reads all INPUT_PERMISSION-* environment variables from process.env, not just declared inputs (source):

GitHub Actions sets INPUT_PERMISSION-DISCUSSIONS for any with: permission-discussions: field, so the value IS forwarded to the GitHub API despite the "Unexpected input" warning in the logs.

2. "Tokens inherit full installation permissions by default"

Only partially true. This is only the case when zero permission-* inputs are specified. When any permission-* field is set (which the compiler always does — permission-contents, permission-issues, etc.), the token is explicitly scoped to only those permissions:

// Returns undefined (inherit all) only when no permissions found
}, undefined);

Omitting permission-discussions causes the minted token to lack discussions access even when the GitHub App installation has that permission.

Impact

• create-discussion safe-outputs fail with permissions errors
• Falls back to issue creation (if fallback-to-issue: true)
• Affects all workflows using GitHub App auth with discussion safe-outputs

Changes

• safe_outputs_app_config.go: Restore permission-discussions mapping with corrected comment explaining the actual behavior
• safe_outputs_app_test.go: Update test to assert permission-discussions: write IS present
• github_app_permissions_validation_test.go: Update test to verify discussions permission IS mapped

Testing

• All modified tests pass (TestSafeOutputsAppTokenDiscussionsPermission, TestConvertPermissionsToAppTokenFields_GitHubAppOnly)
• Pre-existing test failures unrelated to this change

Closes #25704