Skip to content

Make release-notes comment step non-fatal (fixes check_release_notes 403 on bot PRs) #20198

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
T-Gro merged 1 commit into from
Aug 4, 2026
Merged

Make release-notes comment step non-fatal (fixes check_release_notes 403 on bot PRs) #20198

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Fix check_release_notes 403 by restoring pull-requests: write and mak… 
…ing the comment non-fatal

The check_release_notes job posts an informational comment on the PR. Creating a PR comment requires pull-requests: write, but #20081 reduced the token to pull-requests: read. Because the job runs via pull_request_target (GitHub executes the workflow from the default branch), this turned the required check red with HTTP 403 'Resource not accessible by integration' on any PR that needed to create (not update) the comment - e.g. the Maestro/darc PR #20133 targeting release/dev18.0 - even though release-notes validation itself passed.

Restore pull-requests: write so the comment can actually be posted, and additionally guard the comment step with continue-on-error plus a try/catch that downgrades any failure to a warning. The real gate (exit 1 when release notes are genuinely missing) is unchanged, and no PR content is evaluated as JavaScript.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  • Loading branch information
Copilot and Copilot committed Aug 4, 2026
commit fe1352ba5c47818580645e415756db518445236c
57 changes: 35 additions & 22 deletions .github/workflows/check_release_notes.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ on:
permissions:
contents: read
issues: write
pull-requests: read
pull-requests: write
concurrency:
group: release-notes-${{ github.event.pull_request.number }}
cancel-in-progress: true
Expand All @@ -17,7 +17,7 @@ jobs:
permissions:
contents: read
issues: write
pull-requests: read
pull-requests: write
env:
GH_TOKEN: ${{ github.token }}
PR_AUTHOR: ${{ github.event.pull_request.user.login }}
Expand Down Expand Up @@ -305,38 +305,51 @@ jobs:
exit 1
fi
# Keep one bot comment current without evaluating pull request content as JavaScript.
# Posting the informational comment is best-effort and must never fail the check:
# this job runs via pull_request_target, and the Actions GITHUB_TOKEN is not always
# permitted to create a new issue comment (the comment API can return HTTP 403
# "Resource not accessible by integration"), even though release-notes validation
# above has already succeeded.
- name: Create or update comment
if: ${{ (success() || failure()) && steps.release_notes_changes.outputs.release-notes-check-message != '' }}
continue-on-error: true
uses: actions/github-script@v9
env:
COMMENT_BODY: ${{ steps.release_notes_changes.outputs.release-notes-check-message }}
with:
github-token: ${{ github.token }}
script: |
const marker = '<!-- DO_NOT_REMOVE: release_notes_check -->';
const comments = await github.paginate(github.rest.issues.listComments, {
owner: context.repo.owner,
repo: context.repo.repo,
issue_number: context.issue.number,
per_page: 100
});
const existing = comments.find(comment =>
comment.user?.login === 'github-actions[bot]' && comment.body?.includes(marker));

if (existing) {
const comment = await github.rest.issues.updateComment({
try {
const comments = await github.paginate(github.rest.issues.listComments, {
owner: context.repo.owner,
repo: context.repo.repo,
issue_number: context.issue.number,
per_page: 100
});
const existing = comments.find(comment =>
comment.user?.login === 'github-actions[bot]' && comment.body?.includes(marker));

if (existing) {
const comment = await github.rest.issues.updateComment({
owner: context.repo.owner,
repo: context.repo.repo,
comment_id: existing.id,
body: process.env.COMMENT_BODY
});
return comment.data.id;
}

const comment = await github.rest.issues.createComment({
issue_number: context.issue.number,
owner: context.repo.owner,
repo: context.repo.repo,
comment_id: existing.id,
body: process.env.COMMENT_BODY
});
return comment.data.id;
} catch (error) {
// The comment is informational only. The release-notes verdict is enforced by the
// "Check for release notes changes" step, so never fail the job if posting fails
// (e.g. a read-only token on some pull requests).
core.warning(`Unable to post release-notes comment: ${error.message}`);
}

const comment = await github.rest.issues.createComment({
issue_number: context.issue.number,
owner: context.repo.owner,
repo: context.repo.repo,
body: process.env.COMMENT_BODY
});
return comment.data.id;
Loading