fix(github): skip assertPermissions when use_github_token is true
GitHub App bot actors (e.g. my-bot[bot]) return permission: none from the collaborators API because Apps authenticate via installation tokens, not as traditional collaborators. When use_github_token is true, the caller is providing their own GITHUB_TOKEN and managing authentication directly, making the collaborator-level permission check both unnecessary and broken for bot actors. Closes #17224pull/17225/head
parent
184732fc20
commit
23f1de5add
|
|
@ -540,7 +540,12 @@ export const GithubRunCommand = cmd({
|
|||
}
|
||||
// Skip permission check and reactions for repo events (no actor to check, no issue to react to)
|
||||
if (isUserEvent) {
|
||||
await assertPermissions()
|
||||
// Skip permission check when using a custom GitHub token, since the caller
|
||||
// manages their own auth and the collaborator API returns "none" for GitHub
|
||||
// App bot actors (e.g. my-bot[bot]) even though they have valid installation tokens.
|
||||
if (!useGithubToken) {
|
||||
await assertPermissions()
|
||||
}
|
||||
await addReaction(commentType)
|
||||
}
|
||||
|
||||
|
|
|
|||
Loading…
Reference in New Issue