fix: add error handling for GITHUB_TOKEN permissions in pull request comments (#106)

Author: joshjohanning

__tests__/index.test.js

@@ -1511,4 +1511,53 @@ describe('Azure DevOps Commit Validator', () => {
       expect(commentCall.body).toContain('`AB#55555555` (in PR title/body)');
     });
   });
+
+  describe('GitHub token permissions', () => {
+    it('should provide helpful error message when GITHUB_TOKEN lacks pull-requests write permission', async () => {
+      // Mock PR data
+      mockContext.payload.pull_request = {
+        number: 123
+      };
+
+      // Mock commits without AB# pattern
+      mockOctokit.paginate.mockResolvedValueOnce([
+        {
+          sha: 'abc1234567890',
+          commit: { message: 'Fix bug without work item' }
+        }
+      ]);
+
+      // Mock listComments to succeed
+      mockOctokit.paginate.mockResolvedValueOnce([]);
+
+      // Mock createComment to fail with 403 permission error
+      const permissionError = new Error('Resource not accessible by integration');
+      permissionError.status = 403;
+      mockOctokit.rest.issues.createComment.mockRejectedValueOnce(permissionError);
+
+      // Mock inputs
+      mockGetInput.mockImplementation(input => {
+        const inputs = {
+          'check-commits': 'true',
+          'check-pull-request': 'false',
+          'fail-if-missing-workitem-commit-link': 'true',
+          'link-commits-to-pull-request': 'false',
+          'comment-on-failure': 'true',
+          'validate-work-item-exists': 'false',
+          'github-token': 'fake-token',
+          'azure-devops-token': '',
+          'azure-devops-organization': ''
+        };
+        return inputs[input] || '';
+      });
+
+      await run();
+
+      // Should set a helpful error message about missing permissions
+      expect(mockSetFailed).toHaveBeenCalledWith(expect.stringContaining('pull-requests: write'));
+      expect(mockSetFailed).toHaveBeenCalledWith(
+        expect.stringContaining('GITHUB_TOKEN does not have sufficient permissions')
+      );
+    });
+  });
 });

badges/coverage.svg

@@ -1,6 +1,6 @@
 {
   "name": "azure-devops-work-item-link-enforcer-and-linker",
-  "version": "3.0.0",
+  "version": "3.0.1",
   "private": true,
   "type": "module",
   "description": "GitHub Action to enforce that each commit in a pull request be linked to an Azure DevOps work item and automatically link the pull request to each work item ",

package-lock.json

@@ -509,34 +509,46 @@ async function addOrUpdateComment(octokit, context, pullNumber, commentBody, sea
   const commentExtra = `\n<details>\n<summary>Workflow run details</summary>\n\n[View workflow run](${context.payload.repository?.html_url}/actions/runs/${context.runId}) - _Last ran: ${currentDateTime} UTC_\n</details>`;
   const commentCombined = commentBody + commentExtra;
 
-  // Get all comments
-  const comments = await octokit.paginate(octokit.rest.issues.listComments, {
-    owner,
-    repo,
-    issue_number: pullNumber
-  });
-
-  // Find existing comment
-  const existingComment = comments.find(comment => comment.body?.includes(searchText));
-
-  if (existingComment) {
-    console.log(`Comment already exists: ${existingComment.id}`);
-    console.log('... attempting to update the PR comment');
-    await octokit.rest.issues.updateComment({
-      owner,
-      repo,
-      comment_id: existingComment.id,
-      body: commentCombined
-    });
-    console.log('... PR comment updated');
-  } else {
-    console.log('Comment does not exist. Posting a new comment.');
-    await octokit.rest.issues.createComment({
+  try {
+    // Get all comments
+    const comments = await octokit.paginate(octokit.rest.issues.listComments, {
       owner,
       repo,
-      issue_number: pullNumber,
-      body: commentCombined
+      issue_number: pullNumber
     });
+
+    // Find existing comment
+    const existingComment = comments.find(comment => comment.body?.includes(searchText));
+
+    if (existingComment) {
+      console.log(`Comment already exists: ${existingComment.id}`);
+      console.log('... attempting to update the PR comment');
+      await octokit.rest.issues.updateComment({
+        owner,
+        repo,
+        comment_id: existingComment.id,
+        body: commentCombined
+      });
+      console.log('... PR comment updated');
+    } else {
+      console.log('Comment does not exist. Posting a new comment.');
+      await octokit.rest.issues.createComment({
+        owner,
+        repo,
+        issue_number: pullNumber,
+        body: commentCombined
+      });
+    }
+  } catch (error) {
+    if (error.status === 403 && error.message.includes('Resource not accessible by integration')) {
+      core.setFailed(
+        'Unable to comment on pull request. The GITHUB_TOKEN does not have sufficient permissions. ' +
+          'Please add "pull-requests: write" permission to your workflow. ' +
+          'See: https://docs.github.com/en/actions/security-guides/automatic-token-authentication#permissions-for-the-github_token'
+      );
+    } else {
+      throw error;
+    }
   }
 }