fix: prechecks fail when check runs belong to another github app - #498
Open
alechartung wants to merge 2 commits into
Open
fix: prechecks fail when check runs belong to another github app#498alechartung wants to merge 2 commits into
alechartung wants to merge 2 commits into
Conversation
…e by the token
The v12 prechecks GraphQL queries request checkSuite { app { databaseId } }
for every check run. When the workflow token cannot view the GitHub App that
owns a check suite (for example, the Actions GITHUB_TOKEN reading check runs
created by another App installed on the repository), GitHub returns per-node
FORBIDDEN errors alongside an otherwise valid response, and octokit throws
away the usable partial data - failing every deployment on such repositories.
Recover the partial response when every reported error is that App access
failure. The nulled App identity is already handled as an optional
disambiguation hint by latestCheckResults.
GrantBirki
reviewed
Aug 20, 2026
GrantBirki
left a comment
GrantBirki
left a comment
Contributor
There was a problem hiding this comment.
Thanks for tracking this down! Recovering the partial response makes sense here. Two non-blocking suggestions:
- Could we match the expected
checkSuite.apporcheckSuite.app.databaseIdpaths instead of accepting any path that containscheckSuite? I don't see a bypass in the current query, but this keeps a future field undercheckSuitefrom accidentally being treated as optional App metadata. - Could we add a few negative cases through the recovery helper as well? A failed required check, mixed App-access and unrelated errors, a null check node, and duplicate policy-relevant checks with
app: nullwould be useful. Please include a later-page case too. The existing filtering tests cover much of this separately; these cases would help keep missing App metadata from allowing a failing or unverifiable check to pass.
Author
|
Added a commit for those suggestions. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
We ran into failed deploys after upgrading to v12, because we use an internal GitHub App to report some check runs and the workflow token cannot view that App.
v11 was fine because it didn't request
checkSuite { app { databaseId } }.This fixes it by recovering the partial response when every error is
FORBIDDENand scoped tocheckSuiteApp data.Everything else still throws as before.
Includes tests and the regenerated
dist/bundle.Verified by pointing our workflows at this commit and running branch deploys.