From c3afc32585f237005e54981ecc55a5b518017b81 Mon Sep 17 00:00:00 2001 From: Farhan <249513614+farhankhalaf@users.noreply.github.com> Date: Mon, 9 Nov 2026 19:08:07 -0800 Subject: [PATCH] fix(ci): report real errors from the snapshot editor permission check The trusted-editor guard mapped every GitHub API failure to "none", so a 403, rate limit or 5xx read as missing access. Only a 404 (no such user) now maps to "none"; any other failure stops with the API's own error. The guard still fails closed in every case. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/update-snapshots.yaml | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/.github/workflows/update-snapshots.yaml b/.github/workflows/update-snapshots.yaml index 94291ad75..f1e6cd17b 100644 --- a/.github/workflows/update-snapshots.yaml +++ b/.github/workflows/update-snapshots.yaml @@ -60,7 +60,18 @@ jobs: EDITOR: ${{ github.event.sender.login }} run: | set -euo pipefail - permission=$(gh api "repos/${REPO}/collaborators/${EDITOR}/permission" --jq '.permission' 2>/dev/null || echo none) + # Only a 404 (no such user) means "none". Any other API failure + # (403, rate limit, 5xx) stops with the real error so it is + # actionable instead of reading as missing access. + api_error="${RUNNER_TEMP:-/tmp}/editor-permission-error.txt" + if permission=$(gh api "repos/${REPO}/collaborators/${EDITOR}/permission" --jq '.permission' 2>"$api_error"); then + : + elif grep -q '(HTTP 404)' "$api_error"; then + permission=none + else + echo "::error::Could not read ${EDITOR}'s permission on ${REPO}: $(tr '\n' ' ' < "$api_error")" + exit 1 + fi case "$permission" in admin|maintain|write) ;; *)