[code-simplifier] refactor: simplify id-token permission handling with switch statement

[github-actions]

Overview

Simplifies recently merged code from PR #18701 (OIDC/vault action auto-detection) by replacing chained if/else conditions with a clean switch statement in pkg/workflow/safe_outputs_permissions.go.

Files Simplified

• pkg/workflow/safe_outputs_permissions.go — id-token permission logic in ComputePermissionsForSafeOutputs

Improvement Made

Before (repeated nil-pointer dereferences in chained if/else):

if safeOutputs.IDToken != nil && *safeOutputs.IDToken == "none" {
    safeOutputsPermissionsLog.Print("id-token permission explicitly disabled (none)")
} else if safeOutputs.IDToken != nil && *safeOutputs.IDToken == "write" {
    safeOutputsPermissionsLog.Print("id-token: write explicitly requested")
    permissions.Set(PermissionIdToken, PermissionWrite)
} else if stepsRequireIDToken(safeOutputs.Steps) {
    safeOutputsPermissionsLog.Print("Auto-detected OIDC/vault action in steps; adding id-token: write")
    permissions.Set(PermissionIdToken, PermissionWrite)
}

After (single nil deref, switch on the three distinct cases):

idToken := ""
if safeOutputs.IDToken != nil {
    idToken = *safeOutputs.IDToken
}
switch idToken {
case "none":
    safeOutputsPermissionsLog.Print("id-token permission explicitly disabled (none)")
case "write":
    safeOutputsPermissionsLog.Print("id-token: write explicitly requested")
    permissions.Set(PermissionIdToken, PermissionWrite)
default:
    if stepsRequireIDToken(safeOutputs.Steps) {
        safeOutputsPermissionsLog.Print("Auto-detected OIDC/vault action in steps; adding id-token: write")
        permissions.Set(PermissionIdToken, PermissionWrite)
    }
}

This eliminates the duplicated safeOutputs.IDToken != nil nil-checks and uses a switch statement, per the project's standard of preferring switch statements over chained if/else for multi-case logic (per AGENTS.md).

Changes Based On

Recent code merged from:

• Auto-detect OIDC/vault actions in safe-outputs steps and add id-token:write permission #18701 — Auto-detect OIDC/vault actions in safe-outputs steps and add id-token:write permission

Testing

• ✅ All id-token tests pass (TestStepsRequireIDToken, TestComputePermissionsForSafeOutputs_IDToken)
• ✅ Build succeeds (make build)
• ✅ No functional changes — behavior is identical

Review Focus

Please verify that the three cases (explicit "none", explicit "write", auto-detect) produce identical behavior to the original if/else chain.

References:

• §22499596015

Generated by Code Simplifier

• expires on Feb 28, 2026, 7:03 PM UTC