modelcontextprotocol/actions
Watch
1
0
Fork
You've already forked actions
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix: require('@actions/github') not resolvable from external main.js

Browse source 
PR #5 broke the action in production — the require() fails with
MODULE_NOT_FOUND because actions/github-script bundles @actions/github
into dist/index.js; it's not in node_modules and not resolvable from
a sibling require()'d file.

Fix: flip the architecture. github-script's 'github' client now uses
bot-token (GITHUB_TOKEN), so the single 'github' object serves all
user-visible operations. The PAT is passed via env (ORG_TOKEN) and
used ONLY for the team-membership call via github.request() with an
explicit authorization header override.

Side effect: PAT requirements shrink further. It now ONLY needs
Organization Members:read — no repo perms, no Actions:write. All
repo-level operations (including workflow dispatch) use GITHUB_TOKEN
with the workflow's permissions: block.
This commit is contained in:
Den Delimarsky 2026-03-11 20:52:21 +00:00
commit 9fc2acf515
No known key found for this signature in database
1 changed files with 32 additions and 31 deletions
Download patch file Download diff file Expand all files Collapse all files

24
slash-commands/action.yml
View file

@ -9,19 +9,19 @@ description: >-
inputs:
github-token:
description: >-
Token for org team-membership checks and workflow dispatch. MUST have
read:org scope — the default GITHUB_TOKEN cannot do this. Use a
fine-grained PAT with Organization Members:read (+ Actions:write if
using /stageblog), or a GitHub App installation token with equivalent
perms.
Token used for org team-membership checks only. MUST have read:org
scope — the default GITHUB_TOKEN cannot do this. Use a fine-grained PAT
with Organization Members:read, or a GitHub App installation token with
the same.
required: true
bot-token:
description: >-
Token used for user-visible side effects (comments, reactions, labels,
reviews). Defaults to the automatic GITHUB_TOKEN so these show as
authored by github-actions[bot]. The caller workflow must grant this
token the necessary repo permissions (pull-requests: write,
issues: write).
Token used for all repo API calls: comments, reactions, labels, reviews,
CODEOWNERS fetch, listFiles, and workflow dispatch. Defaults to the
automatic GITHUB_TOKEN so user-visible side effects show as authored by
github-actions[bot]. The caller workflow must grant this token the
necessary permissions (pull-requests: write, issues: write,
contents: read; plus actions: write for /stageblog).
required: false
default: ${{ github.token }}
approved-label:
@ -95,9 +95,9 @@ runs:
SUBMIT_REVIEW: ${{ inputs.submit-review }}
STAGEBLOG_WORKFLOW: ${{ inputs.stageblog-workflow }}
STAGEBLOG_PATHS: ${{ inputs.stageblog-paths }}
BOT_TOKEN: ${{ inputs.bot-token }}
ORG_TOKEN: ${{ inputs.github-token }}
with:
github-token: ${{ inputs.github-token }}
github-token: ${{ inputs.bot-token }}
script: |
const main = require(process.env.GITHUB_ACTION_PATH + '/main.js');
await main({ github, context, core });