From 491a6b2701188d2603e329f763f166a636ed9ffa Mon Sep 17 00:00:00 2001 From: bilikas Date: Tue, 9 Jun 2026 17:34:38 +0300 Subject: [PATCH 1/2] Fix: derive bot identity from the token, not the GITHUB_ACTIONS flag Under a user token (e.g. a PAT, including one used inside Actions) the reviewer posts comments as that user, but create() hardcoded botLogin to "github-actions[bot]" whenever GITHUB_ACTIONS=true. So its own prior inline threads came back classified "human", hasUnresolvedBotThreads() was false, and the reconcile/verify follow-up step was skipped. Resolve botLogin from the token via GET /user (correct for user tokens + PATs), falling back to "github-actions[bot]" only when /user 403s (the default Actions App token). Also removes the direct process.env read from github.ts, honoring the "env is read only in loadConfig()" rule. (Also: gitignore the local harness/ subdir.) Co-Authored-By: Claude Opus 4.8 (1M context) --- .gitignore | 4 ++++ src/vcs/github.ts | 20 ++++++++++++++------ 2 files changed, 18 insertions(+), 6 deletions(-) diff --git a/.gitignore b/.gitignore index af98940..9dd09ac 100644 --- a/.gitignore +++ b/.gitignore @@ -3,3 +3,7 @@ node_modules/ .env.local *.log *.sh + +# Agent harness — developed here for context continuity, will be moved to its +# own repo later. Has its own git; kept out of the reviewer repo. +harness/ diff --git a/src/vcs/github.ts b/src/vcs/github.ts index ec8b358..54a75f0 100644 --- a/src/vcs/github.ts +++ b/src/vcs/github.ts @@ -45,12 +45,20 @@ export class GitHubProvider implements VcsProvider { const m = url.match(/^https?:\/\/github\.com\/([^/]+)\/([^/]+)\/pull\/(\d+)/); if (!m) throw new Error(`GitHubProvider: not a GitHub PR URL: ${url}`); const client = octokit ?? new Octokit({ auth: token }); - // Under Actions the GITHUB_TOKEN is an App installation token — - // GET /user returns 403 — but the bot identity is fixed. Elsewhere - // (PATs etc.) we query /user normally. - const botLogin = process.env.GITHUB_ACTIONS === "true" - ? "github-actions[bot]" - : (await client.users.getAuthenticated()).data.login; + // The "bot" identity must match whatever account actually authors the + // comments, or the reconcile/verify step won't recognize its own prior + // threads. Resolve it from the token via GET /user — correct for user tokens + // and PATs, INCLUDING a user PAT used inside Actions. (The old + // `GITHUB_ACTIONS` shortcut forced "github-actions[bot]" there, so under a + // user token the comments came back classified "human" and reconcile got + // skipped.) Only the default Actions GITHUB_TOKEN — an App installation + // token — 403s on GET /user; fall back to the fixed bot login then. + let botLogin: string; + try { + botLogin = (await client.users.getAuthenticated()).data.login; + } catch { + botLogin = "github-actions[bot]"; + } return new GitHubProvider(client, m[1]!, m[2]!, parseInt(m[3]!, 10), botLogin); } From 6eb83b0fbfdcc3c3d3a70d6de93a0923e2e2aa0e Mon Sep 17 00:00:00 2001 From: bilikas Date: Tue, 9 Jun 2026 17:49:51 +0300 Subject: [PATCH 2/2] Build dist for the bot-identity fix Co-Authored-By: Claude Opus 4.8 (1M context) --- dist/vcs/github.js | 21 +++++++++++++++------ 1 file changed, 15 insertions(+), 6 deletions(-) diff --git a/dist/vcs/github.js b/dist/vcs/github.js index a9cbab0..8db54ed 100644 --- a/dist/vcs/github.js +++ b/dist/vcs/github.js @@ -31,12 +31,21 @@ export class GitHubProvider { if (!m) throw new Error(`GitHubProvider: not a GitHub PR URL: ${url}`); const client = octokit ?? new Octokit({ auth: token }); - // Under Actions the GITHUB_TOKEN is an App installation token — - // GET /user returns 403 — but the bot identity is fixed. Elsewhere - // (PATs etc.) we query /user normally. - const botLogin = process.env.GITHUB_ACTIONS === "true" - ? "github-actions[bot]" - : (await client.users.getAuthenticated()).data.login; + // The "bot" identity must match whatever account actually authors the + // comments, or the reconcile/verify step won't recognize its own prior + // threads. Resolve it from the token via GET /user — correct for user tokens + // and PATs, INCLUDING a user PAT used inside Actions. (The old + // `GITHUB_ACTIONS` shortcut forced "github-actions[bot]" there, so under a + // user token the comments came back classified "human" and reconcile got + // skipped.) Only the default Actions GITHUB_TOKEN — an App installation + // token — 403s on GET /user; fall back to the fixed bot login then. + let botLogin; + try { + botLogin = (await client.users.getAuthenticated()).data.login; + } + catch { + botLogin = "github-actions[bot]"; + } return new GitHubProvider(client, m[1], m[2], parseInt(m[3], 10), botLogin); } async getPRMetadata() {