ci(cmd-bot): post PR comments via the App token, not GITHUB_TOKEN#246
Conversation
The /cmd dispatcher's before-cmd / after-cmd / finish jobs comment and react on
the PR using `secrets.GITHUB_TOKEN`. That token is capped read-only by org
policy — the repo's workflow-permissions setting reads "write", yet runs still
get HTTP 403 "Resource not accessible by integration" on
`POST /issues/{n}/comments`. So every non-quiet /cmd run dies at the first step
("Comment PR (Start)") before the command itself runs, and only the 👀 reaction
ever appears (the failure comment 403s too).
Route the comment + reaction steps through the CMD_BOT GitHub App token (scoped
to issues + pull-requests write) — the same App token already used for the push
in after-cmd, which works precisely because it is not subject to the org
GITHUB_TOKEN cap. The read-only "Build workflow link" curl keeps GITHUB_TOKEN.
Prerequisite: the CMD_BOT App installation must grant issues + pull-requests
write (it already grants contents write for the push). To take effect for live
/cmd runs this must also reach the `cmd-bot` branch the dispatch runs from
(via the usual dev -> cmd-bot sync).
There was a problem hiding this comment.
For cmd-run.yml changes, you can manual verify by below cli, then post result!
gh workflow run cmd-run.yml \
--ref <YOUR_BRANCH_NAME> \
-f cmd="${CMD}" \
-f repo="${REPO}" \
-f pr_branch="${PR_BRANCH}" \
-f pr_num="${PR_NUMBER}" \
-f runner="${RUNNER}" \
-f is_org_member="${IS_ORG_MEMBER}" \
-f comment_id="${COMMENT_ID}" \
-f image="${IMAGE}" \
-f is_quiet="${IS_QUIET}"Reminder: Also merge cmd-run related changes to cmd-bot branch after this PR merged.
|
Manually verified by dispatching this branch's All App-token comment/reaction steps pass (these 403'd on
The bot posted the start/failure comments on this PR (throwaway test comments, since deleted). The Reminder per review: this also needs mirroring to the |
|
Why 😕 here: #125 (comment)? 
:D :D could be related to this PR? |
3 participants
Problem
Every non-
--quiet/cmdrun currently dies at its first step. Thecmd-run.ymljobs comment/react on the PR usingsecrets.GITHUB_TOKEN, and that token gets HTTP 403 "Resource not accessible by integration" onPOST /repos/.../issues/{n}/comments— even though the repo's Actions workflow-permissions setting readswrite. Sobefore-cmd → Comment PR (Start)fails, thecmd(e.g.bench) step is skipped, and the only visible signal is the 👀 acknowledgement reaction (the failure comment 403s too).Evidence: the same workflow commented successfully on a PR as recently as Jun 13 (run
27460868652, PR #172), then began 403ing (Jun 17, Jun 26). The repo token setting iswrite, yet runs still 403 — i.e. the cap is at the org level (a policy override the repo setting can't relax), applied in that window.Fix
Route the comment + reaction steps in
before-cmd,after-cmd, andfinishthrough the CMD_BOT GitHub App token (scoped toissues+pull-requests: write) instead ofGITHUB_TOKEN. This is the same App token already used for the result push inafter-cmd, which works precisely because an App token's scope comes from the App installation and isn't subject to the orgGITHUB_TOKENcap. The read-only "Build workflow link" curl keeps usingGITHUB_TOKEN.Prerequisites / notes
issues+pull-requests: write(it already grantscontents: writefor the push). If it doesn't, the newcreate-github-app-tokensteps will fail at token generation and need that scope added in the App settings./cmddispatchescmd-run.ymlfrom thecmd-botbranch (gh workflow run --ref cmd-bot), so this change only takes effect for live runs once it reachescmd-botvia the usualdev→cmd-botsync.cmd-botcopy), so this hasn't been run end-to-end.