fix: replace - with _ (#246)

lib/get-permissions-from-inputs.js

@@ -10,7 +10,8 @@ export function getPermissionsFromInputs(env) {
     if (!key.startsWith("INPUT_PERMISSION-")) return permissions;
     if (!value) return permissions;
 
-    const permission = key.slice("INPUT_PERMISSION-".length).toLowerCase();
+    const permission = key.slice("INPUT_PERMISSION-".length).toLowerCase()
+      .replaceAll(/-/g, "_");
 
     // Inherit app permissions if no permissions inputs are set
     if (permissions === undefined) {

tests/snapshots/index.js.md

@@ -331,7 +331,7 @@ Generated by [AVA](https://avajs.dev).
     --- REQUESTS ---␊
     GET /repos/actions/create-github-app-token/installation␊
     POST /app/installations/123456/access_tokens␊
-    {"repositories":["create-github-app-token"],"permissions":{"issues":"write","pull-requests":"read"}}`
+    {"repositories":["create-github-app-token"],"permissions":{"issues":"write","pull_requests":"read"}}`
 
 ## post-revoke-token-fail-response.test.js