feat: permissions (#168)

- Load `app-permissions` from schema exported by `@octokit/openapi`
- Update documentation in README.md
- Implement the `permissions_*` inputs in the action code

---------

Co-authored-by: Parker Brown <17183625+parkerbxyz@users.noreply.github.com>

main.js

@@ -5,6 +5,7 @@ import { createAppAuth } from "@octokit/auth-app";
 
 import { main } from "./lib/main.js";
 import request from "./lib/request.js";
+import { getPermissionsFromInputs } from "./lib/get-permissions-from-inputs.js";
 
 if (!process.env.GITHUB_REPOSITORY) {
   throw new Error("GITHUB_REPOSITORY missing, must be set to '<owner>/<repo>'");
@@ -25,24 +26,29 @@ if (!privateKey) {
   throw new Error("Input required and not supplied: private-key");
 }
 const owner = core.getInput("owner");
-const repositories = core.getInput("repositories")
+const repositories = core
+  .getInput("repositories")
   .split(/[\n,]+/)
-  .map(s => s.trim())
-  .filter(x => x !== '');
+  .map((s) => s.trim())
+  .filter((x) => x !== "");
 
 const skipTokenRevoke = Boolean(
-  core.getInput("skip-token-revoke") || core.getInput("skip_token_revoke")
+  core.getInput("skip-token-revoke") || core.getInput("skip_token_revoke"),
 );
 
-main(
+const permissions = getPermissionsFromInputs(process.env);
+
+// Export promise for testing
+export default main(
   appId,
   privateKey,
   owner,
   repositories,
+  permissions,
   core,
   createAppAuth,
   request,
-  skipTokenRevoke
+  skipTokenRevoke,
 ).catch((error) => {
   /* c8 ignore next 3 */
   console.error(error);