never let check-write-access fail the review chain (#10505)

check-write-access is additive by design: every caller ORs its `authorized`
output with `github.event.comment.author_association`, so a failure should
degrade to the author_association path, not block anything.

It does not. `claude`, `codex` and `pi` all `needs: [parse, check-access, plan]`,
so a failed check-access skips `plan` and with it all three reviewers. Any
disruption to the app credentials — an unset `INTERNAL_APP_ID`, a rotated
`INTERNAL_APP_KEY`, the app uninstalled from the org — turns a redundant
authorization probe into a total /review outage.

Guard the token minting and fall back to the default token, which still resolves
public members and repo collaborators; private members fall through to
author_association exactly as they did before this workflow existed.

Found while porting these workflows to windmill-helm-charts
(windmill-labs/windmill-helm-charts#656), where the app credentials are not
guaranteed to be present.

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

.github/workflows/check-write-access.yml

@@ -30,8 +30,14 @@ jobs:
     outputs:
       authorized: ${{ steps.check.outputs.authorized }}
     steps:
+      # This check is purely additive: callers OR it with author_association, so it must
+      # never fail the job. Failing here would block every dependent reviewer job through
+      # `needs`, turning an unconfigured or misconfigured app into a total review outage
+      # rather than a fallback to the author_association path.
       - name: Mint internal app token
         id: app
+        if: vars.INTERNAL_APP_ID != ''
+        continue-on-error: true
         uses: actions/create-github-app-token@v2
         with:
           app-id: ${{ vars.INTERNAL_APP_ID }}
@@ -41,7 +47,9 @@ jobs:
       - name: Resolve authorization
         id: check
         env:
-          GH_TOKEN: ${{ steps.app.outputs.token }}
+          # Without the app token, the default token still resolves public members and
+          # repo collaborators; private members simply fall through to author_association.
+          GH_TOKEN: ${{ steps.app.outputs.token || github.token }}
           USERNAME: ${{ inputs.username }}
           TRUSTED_BOT: ${{ inputs.trusted_bot }}
           REPO: ${{ github.repository }}