Repository navigation
lockdown mode fails to check permissions of custom bot accounts when retrieving pull request reviews #3777
Description
Describe the bug
failed to check lockdown mode: failed to get user permission level: GET https://api.github.com/repos/<org>/<repo>/collaborators/<bot-user>/permission: 404 <bot-user> is not a user
Notably <bot-user> is missing the <bot-user>[bot] suffix from it's login, hence the permission check fails.
Affected version
https://api.githubcopilot.com/mcp/
Steps to reproduce the behavior
- Create a PR with a PR review from a bot user
- Call the get_review_comments tool with lockdown
- See error
Expected vs actual behavior
Permissions for bot users should check the original login <bot-user>[bot], without stripping the [bot] suffix.
Logs
It seems that the GraphQL's Actor Login field differs from the Rest API's user.login` field.
gh api graphql -F owner=':owner' -F repo=':repo' -F pr=123 -f query='
query($owner: String!, $repo: String!, $pr: Int!) {
repository(owner: $owner, name: $repo) {
pullRequest(number: $pr) {
reviewThreads(first: 100) {
nodes {
isResolved
path
line
comments(first: 50) {
nodes {
id
body
createdAt
author {
login
}
}
}
}
}
}
}
}
'So the bug comes from taking the graphql login, and checking it against the REST API.
Similar workarounds using author { login __typename } brave/pull-merge#405, costajohnt/oss-autopilot#1703, gptme/gptme-contrib#1786
Activity