fix(github): skip assertPermissions when use_github_token is true

GitHub App bot actors (e.g. my-bot[bot]) return permission: none from
the collaborators API because Apps authenticate via installation tokens,
not as traditional collaborators.

When use_github_token is true, the caller is providing their own
GITHUB_TOKEN and managing authentication directly, making the
collaborator-level permission check both unnecessary and broken for
bot actors.

Closes #17224
pull/17225/head
Samuel Briole 2026-03-12 19:34:50 +01:00
parent 184732fc20
commit 23f1de5add
1 changed files with 6 additions and 1 deletions

View File

@ -540,7 +540,12 @@ export const GithubRunCommand = cmd({
}
// Skip permission check and reactions for repo events (no actor to check, no issue to react to)
if (isUserEvent) {
await assertPermissions()
// Skip permission check when using a custom GitHub token, since the caller
// manages their own auth and the collaborator API returns "none" for GitHub
// App bot actors (e.g. my-bot[bot]) even though they have valid installation tokens.
if (!useGithubToken) {
await assertPermissions()
}
await addReaction(commentType)
}