fix: handle non-user actors (e.g. Copilot) in permission and actor checks by krislavten · Pull Request #1144 · anthropics/claude-code-action

krislavten · 2026-04-02T02:14:43Z

Summary

GitHub Apps like Copilot SWE Agent set GITHUB_ACTOR to a value (e.g. "Copilot") that is neither a valid GitHub user nor ends with [bot]. This causes two independent crashes in the action:

checkWritePermissions (permissions.ts): calls the collaborator permission API → 404 "Copilot is not a user"
checkHumanActor (actor.ts): calls octokit.users.getByUsername() → 404 before reaching the allowed_bots check

Root Cause

Both functions assume the actor is either a real GitHub user or a [bot]-suffixed app. Some GitHub Apps (Copilot, and potentially future ones) use a plain name as GITHUB_ACTOR that doesn't match either pattern.

Fix

permissions.ts:

Check allowed_bots before calling the collaborator API, so known bots skip the API entirely
Catch "is not a user" 404 errors and fall back to allowed_bots check instead of crashing

actor.ts:

Move allowed_bots check before the octokit.users.getByUsername() call
Catch 404 errors and provide a clear error message telling the user to add the bot to allowed_bots

Tests

Added 11 new test cases covering:

Non-[bot] actor in allowed_bots list (both pre-API and 404 fallback paths)
Wildcard * for non-[bot] actors
Non-[bot] actor NOT in allowed_bots (returns false / clear error message)
Case-insensitive matching
Non-404 errors still propagate correctly

All 664 existing tests continue to pass.

Closes

checkHumanActor fails with 404 for bot actors before checking allowed_bots configuration #900 — checkHumanActor fails with 404 before checking allowed_bots
Title: Support for GitHub Copilot-created Pull Requests #903 — Support for GitHub Copilot-created Pull Requests
checkWritePermissions fails with 404 for non-user actors like Copilot #1018 — checkWritePermissions fails with 404 for non-user actors
allowed_bots bypasses actor check but not permission check — bot actors still fail with 404 #1133 — allowed_bots bypasses actor check but not permission check

…ecks GitHub Apps like Copilot SWE Agent set GITHUB_ACTOR to a value (e.g. "Copilot") that is neither a valid GitHub user nor ends with "[bot]". This caused two independent crashes: 1. checkWritePermissions (permissions.ts): called the collaborator permission API which returns 404 "is not a user" for non-user actors. 2. checkHumanActor (actor.ts): called the Users API first, which 404s, before ever reaching the allowed_bots check. Fix both by: - Checking allowed_bots BEFORE making API calls, so known bots skip the API entirely. - In permissions.ts, catching "is not a user" 404 errors and falling back to the allowed_bots list instead of crashing. - In actor.ts, catching 404 errors and providing a clear error message telling the user to add the bot to allowed_bots. Closes anthropics#900, anthropics#903, anthropics#1018, anthropics#1133 Co-Authored-By: Claude Opus 4.6 <[email protected]>

fallemand · 2026-04-15T17:26:33Z

We are facing this issue. Thanks!

ashwin-ant · 2026-04-15T18:06:17Z

@krislavten mind running bun run format and pushing again?

## Summary Copilot PR reviews have been silently failing claude-code-action@v1 — its `checkHumanActor` step calls `octokit.users.getByUsername('Copilot')`, which 404s because `Copilot` is a virtual actor with no user record. No action input bypasses that lookup (upstream PRs [#1018](anthropics/claude-code-action#1018), [#1030](anthropics/claude-code-action#1030), [#1144](anthropics/claude-code-action#1144) are all still open). Observed on [navigaite/edilio#94 run 24551381827](https://github.com/navigaite/edilio/actions/runs/24551381827/job/71777721521): ``` Checking permissions for actor: Copilot GET /users/Copilot - 404 Action failed with error: Not Found ``` ## Fix Proxy Copilot reviews into an `issue_comment` event that Claude's existing pipeline can handle: - **New `repost-copilot-review` job** in the reusable `claude-code.yaml`. Fires only when `pull_request_review.user.type == 'Bot'` and login contains `copilot`. Mints the Navigaite workflow App token, fetches the review's inline comments via `GET /pulls/:n/reviews/:id/comments`, and posts a single stitched `@claude …` comment on the PR. - **Skip the `claude` job on Copilot reviews** — it would hit the 404. The spawned `issue_comment` re-enters the job with `github.actor == 'navigaite-workflow-app[bot]'`, a real bot user that resolves, so `checkHumanActor`'s `allowed_bots: *` branch takes over. - **Relax the `issue_comment` author-association gate** (both the reusable workflow step and the caller template's `if:`) to admit comments from `navigaite-workflow-app[bot]`. Reposted comments have `author_association: NONE` by construction — trust is anchored in the fact that only our installed app can mint its own token. ## Test plan - [ ] Merge, re-request Copilot review on an open PR in a consumer repo, confirm: (1) `repost-copilot-review` job succeeds, (2) an `@claude …` comment appears on the PR, (3) a follow-up `issue_comment` run of the `claude` job runs to completion without the `users/Copilot` 404. - [ ] Confirm human `@claude` comments still trigger Claude normally (unchanged path). - [ ] Confirm unrelated bot comments (Dependabot, github-actions) are still filtered out by the association gate. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.7 (1M context) <[email protected]>

crocodele · 2026-04-27T23:37:37Z

Would be lovely to get these fixes merged. 🙏

ashwin-ant approved these changes Apr 15, 2026

View reviewed changes

maxbec mentioned this pull request Apr 18, 2026

fix(ci): repost Copilot reviews as @claude comments navigaite/.github#99

Merged

3 tasks

This was referenced Apr 20, 2026

Pin anthropics/claude-code-action to v1.0.88 to work around upstream ENOENT/tsconfig regression 0xferit/manuscript-decentralized-curation#106

Merged

Re-enable claude-review on Copilot- and Dependabot-authored PRs 0xferit/manuscript-decentralized-curation#107

Open

coderabbitai Bot mentioned this pull request Apr 25, 2026

Add Claude Code GitHub Workflow iamtanbirahmed/gantry#4

Merged

ashwin-ant merged commit 9eb125a into anthropics:main May 14, 2026
5 of 37 checks passed

YoAm mentioned this pull request May 23, 2026

pull_request.labeled / issues.labeled events fail with 401 Bad credentials at checkHumanActor under default OIDC + federation auth #1348

Open

github-actions Bot mentioned this pull request May 28, 2026

fix(deps): update anthropics/claude-code-action action to v1.0.133 koki-develop/claude-renovate-review#47

Open

1 task

coderabbitai Bot mentioned this pull request Jun 5, 2026

feat(ci): adopt canonical no-dedup bypass-audit standard chris-yyau/busdriver#181

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: handle non-user actors (e.g. Copilot) in permission and actor checks#1144

fix: handle non-user actors (e.g. Copilot) in permission and actor checks#1144
ashwin-ant merged 1 commit into
anthropics:mainfrom
krislavten:fix/handle-non-user-actor-permission-check

krislavten commented Apr 2, 2026

Uh oh!

fallemand commented Apr 15, 2026

Uh oh!

ashwin-ant commented Apr 15, 2026

Uh oh!

crocodele commented Apr 27, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

krislavten commented Apr 2, 2026

Summary

Root Cause

Fix

Tests

Closes

Related

Uh oh!

fallemand commented Apr 15, 2026

Uh oh!

ashwin-ant commented Apr 15, 2026

Uh oh!

crocodele commented Apr 27, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants