Skip to content

fix: search all comment pages and clarify fork token errors - #257

Merged
michisec merged 1 commit into
mainfrom
fix/comment-pagination-fork-token
Nov 7, 2026
Merged

michisec merged 1 commit into
mainfrom
fix/comment-pagination-fork-token

Conversation

@michisec

@michisec michisec commented Nov 7, 2026

Copy link
Copy Markdown
Owner

This pull request improves support and error handling for posting comments on pull requests, especially those originating from forks, and enhances test coverage and documentation. The most important changes are summarized below.

Error handling and messaging for fork pull requests:

  • Added a new APIError type and IsForbidden helper to detect GitHub API 403 errors, which typically occur when attempting to comment on pull requests from forks with a read-only token. The action now logs a clear warning and provides guidance on how to enable commenting (e.g., using pull_request_target or a write-capable token). [1] [2]
  • Updated the README with a new section explaining why comments may fail on fork PRs, how to resolve this, and security considerations when using pull_request_target.

Comment handling improvements:

  • Removed the maxCommentPages limit and updated the comment search logic to scan all pages, preventing duplicate comments when a pull request has many comments. [1] [2]

Testing enhancements:

  • Added tests to verify that all comment pages are searched before creating a new comment and that the action logs the correct warning when a forbidden error occurs. [1] [2] [3]

Codebase maintenance:

  • Minor code improvements, such as new imports to support testing and refactoring for clarity.

Documentation updates:

  • Removed outdated v2 changelog information from the README to keep documentation current.

Search every page of pull request comments before creating a new comment so an existing marker is found even on threads with more than 1,000 comments. This avoids posting a duplicate warning on every synchronize run.

Return a typed API error and add a warning hint when the GitHub API responds with 403, explaining that the default token is read-only for pull requests from forks. Document trusted, write-enabled options in the README.
@michisec
michisec merged commit 8d922d8 into main Nov 7, 2026
5 checks passed
@michisec
michisec deleted the fix/comment-pagination-fork-token branch November 7, 2026 21:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant