From 141ed7bae0592f433bfdc9455e4eccecc6426857 Mon Sep 17 00:00:00 2001 From: Ruben Fiszel Date: Tue, 4 Aug 2026 11:38:51 +0000 Subject: [PATCH] never let check-write-access fail the review chain (#10505) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit check-write-access is additive by design: every caller ORs its `authorized` output with `github.event.comment.author_association`, so a failure should degrade to the author_association path, not block anything. It does not. `claude`, `codex` and `pi` all `needs: [parse, check-access, plan]`, so a failed check-access skips `plan` and with it all three reviewers. Any disruption to the app credentials — an unset `INTERNAL_APP_ID`, a rotated `INTERNAL_APP_KEY`, the app uninstalled from the org — turns a redundant authorization probe into a total /review outage. Guard the token minting and fall back to the default token, which still resolves public members and repo collaborators; private members fall through to author_association exactly as they did before this workflow existed. Found while porting these workflows to windmill-helm-charts (windmill-labs/windmill-helm-charts#656), where the app credentials are not guaranteed to be present. Co-authored-by: Claude Opus 5 (1M context) --- .github/workflows/check-write-access.yml | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/.github/workflows/check-write-access.yml b/.github/workflows/check-write-access.yml index 5e9494e74a..097fc3b3dd 100644 --- a/.github/workflows/check-write-access.yml +++ b/.github/workflows/check-write-access.yml @@ -30,8 +30,14 @@ jobs: outputs: authorized: ${{ steps.check.outputs.authorized }} steps: + # This check is purely additive: callers OR it with author_association, so it must + # never fail the job. Failing here would block every dependent reviewer job through + # `needs`, turning an unconfigured or misconfigured app into a total review outage + # rather than a fallback to the author_association path. - name: Mint internal app token id: app + if: vars.INTERNAL_APP_ID != '' + continue-on-error: true uses: actions/create-github-app-token@v2 with: app-id: ${{ vars.INTERNAL_APP_ID }} @@ -41,7 +47,9 @@ jobs: - name: Resolve authorization id: check env: - GH_TOKEN: ${{ steps.app.outputs.token }} + # Without the app token, the default token still resolves public members and + # repo collaborators; private members simply fall through to author_association. + GH_TOKEN: ${{ steps.app.outputs.token || github.token }} USERNAME: ${{ inputs.username }} TRUSTED_BOT: ${{ inputs.trusted_bot }} REPO: ${{ github.repository }}