fix(ci): tolerate periphery comment permission denials

vincentkoc · vincentkoc · commit 65131633a132 · 2026-07-06T11:18:58.000+02:00
diff --git a/.github/workflows/ios-periphery-comment.yml b/.github/workflows/ios-periphery-comment.yml
@@ -464,19 +464,31 @@ jobs:
               return;
             }
 
-            if (existing) {
-              await github.rest.issues.updateComment({
+            const writeComment = async () => {
+              if (existing) {
+                await github.rest.issues.updateComment({
+                  owner,
+                  repo,
+                  comment_id: existing.id,
+                  body,
+                });
+                return;
+              }
+
+              await github.rest.issues.createComment({
                 owner,
                 repo,
-                comment_id: existing.id,
+                issue_number: livePull.data.number,
                 body,
               });
-              return;
-            }
+            };
 
-            await github.rest.issues.createComment({
-              owner,
-              repo,
-              issue_number: livePull.data.number,
-              body,
-            });
+            try {
+              await writeComment();
+            } catch (error) {
+              if (error && typeof error === "object" && error.status === 403) {
+                core.warning(`Skipping Periphery PR comment for #${pr.number}; GitHub token cannot write issue comments for this workflow_run.`);
+                return;
+              }
+              throw error;
+            }
diff --git a/test/scripts/ios-periphery-comment-workflow.test.ts b/test/scripts/ios-periphery-comment-workflow.test.ts
@@ -147,6 +147,7 @@ async function runCommenter(
   archiveData: Buffer,
   options: {
     existingComments?: ExistingComment[];
+    commentErrorStatus?: number;
     liveHeadSha?: string;
     liveHeadShaAfter?: string;
     runHeadSha?: string;
@@ -187,9 +188,19 @@ async function runCommenter(
       issues: {
         listComments() {},
         async createComment(params: { body: string }) {
+          if (options.commentErrorStatus) {
+            throw Object.assign(new Error("comment write failed"), {
+              status: options.commentErrorStatus,
+            });
+          }
           createdBodies.push(params.body);
         },
         async updateComment(params: { body: string }) {
+          if (options.commentErrorStatus) {
+            throw Object.assign(new Error("comment write failed"), {
+              status: options.commentErrorStatus,
+            });
+          }
           updatedBodies.push(params.body);
         },
       },
@@ -924,6 +935,37 @@ describe("iOS Periphery comment workflow", () => {
     expect(result.createdBodies[0]?.length).toBeLessThanOrEqual(60_000);
   });
 
+  it("warns without failing when workflow_run token cannot write comments", async () => {
+    const archive = makeZip({
+      "periphery.json": JSON.stringify([
+        {
+          kind: "function",
+          location: "Sources/Test.swift:12",
+          name: "unused",
+        },
+      ]),
+      "periphery.status": "1\n",
+    });
+    const result = await runCommenter(
+      {
+        expired: false,
+        id: 77,
+        name: ARTIFACT_NAME,
+        size_in_bytes: archive.length,
+      },
+      archive,
+      {
+        commentErrorStatus: 403,
+      },
+    );
+
+    expect(result.createdBodies).toEqual([]);
+    expect(result.updatedBodies).toEqual([]);
+    expect(result.core.warnings).toContain(
+      "Skipping Periphery PR comment for #123; GitHub token cannot write issue comments for this workflow_run.",
+    );
+  });
+
   it("does not overwrite a marker comment owned by another bot", async () => {
     const archive = makeZip({
       "periphery.json": JSON.stringify([
