From fd79749a3a16459f03bd93685bf30ead52b6a473 Mon Sep 17 00:00:00 2001 From: Rashmi Advani Date: Mon, 17 Aug 2026 00:43:57 -0700 Subject: [PATCH] ci: stop auto-assign failing on bot and fork pull requests The Auto Assign PR workflow failed on two entire classes of PR, leaving a red check unrelated to the change under review: * Dependabot PRs -- bot accounts are not assignable, so the API returned 403 Forbidden for {"assignees":["dependabot[bot]"]}. * Fork PRs -- fork-originated pull_request runs get a read-only GITHUB_TOKEN, so addAssignees returned 403 "Resource not accessible by integration" regardless of the permissions block. Guard the job so it runs only when assignment can succeed: the PR must originate in this repository and the author must not be a bot. Also grant `issues: write`, since addAssignees belongs to the issues API and was not covered by the existing `pull-requests: write` grant. Not switched to pull_request_target: that grants a writable token, but GitHub silently ignores assignees without push access, so fork authors still would not be assigned -- a security-sensitive trigger for a green check that does nothing. --- .github/workflows/auto-assign.yml | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/.github/workflows/auto-assign.yml b/.github/workflows/auto-assign.yml index 6080a08..5f438f5 100644 --- a/.github/workflows/auto-assign.yml +++ b/.github/workflows/auto-assign.yml @@ -5,10 +5,20 @@ on: types: [opened] permissions: + issues: write pull-requests: write jobs: assign: + # Skip the cases where assignment can never succeed, rather than failing: + # * Fork PRs get a read-only GITHUB_TOKEN, so addAssignees returns 403 + # 'Resource not accessible by integration' regardless of the + # permissions granted below. + # * Bot accounts such as dependabot[bot] are not assignable and return + # 403 Forbidden. + if: >- + github.event.pull_request.head.repo.full_name == github.repository + && github.event.pull_request.user.type != 'Bot' runs-on: ubuntu-latest steps: - name: Assign PR to author