A própria *operação de rota* também declara o escopo, `"items"`, então ele também estará na lista de `security_scopes.scopes` passado para o `get_current_user`.

Aqui está como a hierarquia de dependências e escopos parecem:

                skipConditionally()
            }
        }

        fun BuildSteps.adHocPerformanceTest(tests: List<String>) {
            gradleStep(
                listOf(
                    "clean",
                    "performance:${testProject}PerformanceAdHocTest",
                    tests.map { """--tests "$it"""" }.joinToString(" "),

    fun asName() = name.lowercase().toCapitalized()

    fun javaInstallationLocations(arch: Arch = Arch.AMD64): List<String> {
        val paths =
            when {
                this == LINUX ->
                    listOf(
                        DefaultJvm(JvmVersion.JAVA_8, JvmVendor.ORACLE),
                        DefaultJvm(JvmVersion.JAVA_11, JvmVendor.OPENJDK),
                        DefaultJvm(JvmVersion.JAVA_17, JvmVendor.OPENJDK),

    os: Os = Os.LINUX,
    arch: Arch = Arch.AMD64,
    testJavaVersion: String = os.perfTestJavaVersion.major.toString(),
    testJavaVendor: String = os.perfTestJavaVendor.name.lowercase(),
) = listOf(
    "$task${if (extraParameters.isEmpty()) "" else " $extraParameters"}",
    "-PperformanceBaselines=$baselines",
    "-PtestJavaVersion=$testJavaVersion",
    "-PtestJavaVendor=$testJavaVendor",

                failureMessage = "This build might be leaking credentials"
                reverse = false
                stopBuildOnFailure = true
            }
        }
    }

    if (os !in listOf(Os.WINDOWS, Os.MACOS)) {
        steps {
            exec {
                name = "EC2_BUILD_CUSTOMIZATIONS"
                executionMode = BuildStep.ExecutionMode.ALWAYS

        description = "Check links in documentations"

        applyDefaults(
            model,
            this,
            ":docs:checkLinks",
            extraParameters =
                listOf(
                    buildScanTagParam("CheckLinks"),
                    "-Dorg.gradle.java.installations.auto-download=false",
                    "-Porg.gradle.java.installations.auto-download=false",

        }

        applyDefaults(
            model,
            this,
            ":build-logic:test -PskipBuildLogicTests=false",
            extraParameters =
                listOf(
                    stage.getBuildScanCustomValueParam(),
                    buildScanTagParam("BuildLogitTest"),
                    "-Dorg.gradle.java.installations.auto-download=false",

        }

        applyDefaults(
            model,
            this,
            "compileAllBuild -PignoreIncomingBuildReceipt=true -DdisableLocalCache=true",
            extraParameters =
                listOf(
                    stage.getBuildScanCustomValueParam(),
                    buildScanTagParam("CompileAll"),
                    "-Dorg.gradle.java.installations.auto-download=false",

La *path operation* en sí también declara un scope, `"items"`, por lo que esto también estará en la lista de `security_scopes.scopes` pasado a `get_current_user`.

Así es como se ve la jerarquía de dependencias y scopes:

        features {
            publishBuildStatusToGithub(model)
        }

        applyDefaults(
            model,
            this,
            "sanityCheck",
            extraParameters =
                listOf(
                    stage.getBuildScanCustomValueParam(),
                    buildScanTagParam("SanityCheck"),
                    "-Dorg.gradle.java.installations.auto-download=false",