check-write-access is additive by design: every caller ORs its `authorized`
output with `github.event.comment.author_association`, so a failure should
degrade to the author_association path, not block anything.
It does not. `claude`, `codex` and `pi` all `needs: [parse, check-access, plan]`,
so a failed check-access skips `plan` and with it all three reviewers. Any
disruption to the app credentials — an unset `INTERNAL_APP_ID`, a rotated
`INTERNAL_APP_KEY`, the app uninstalled from the org — turns a redundant
authorization probe into a total /review outage.
Guard the token minting and fall back to the default token, which still resolves
public members and repo collaborators; private members fall through to
author_association exactly as they did before this workflow existed.
Found while porting these workflows to windmill-helm-charts
(windmill-labs/windmill-helm-charts#656), where the app credentials are not
guaranteed to be present.
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix(ci): gate auto-review on non-fork PR not author_association (skips private members)
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(ci): authorize private org members for command workflows via app-token gate
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Ruben FiszelandClaude Opus 5