Repository navigation
fix: allow write collaborators and repair command acknowledgements - #6
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Outside collaborators with repository write access cannot invoke
/codex-reviewbecause both caller templates and the review implementations require OWNER or MEMBER association. Separately, the acknowledgement job receives a 403 when reacting to PR conversation comments with only pull-requests: read.Authorize the original comment author through GitHub's repository permission API, requiring write, maintain, or admin access. Check access before acknowledgement and again in the same-repository composite action or fork workflow. Reject missing authors and failed permission lookups. The caller filters exact PR commands; authorization no longer relies on organization membership.
Give the resolver pull-requests: write alongside its existing issues: write permission for PR comment reactions. It still performs no checkout and receives no Azure secrets. Keep reaction failures non-fatal and preserve fork isolation.
Validation: 70 Node tests passed, including permission and acknowledgement regressions; actionlint and git diff --check passed. Downstream PRs will apply the caller changes and pin this implementation.
Live verification: https://github.com/codemod/codemod-app/actions/runs/37519947116 passed with the repository GITHUB_TOKEN, authorizing Siamak and adding 👀 to the reported PR comment. Temporary verification code was removed from the app PR.
Consumer updates: codemod/codemod-app#1160, codemod/arc-codemods#1181, codemod/codemod#2437.