modelcontextprotocol/actions
Watch
1
0
Fork
You've already forked actions
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge pull request #7 from modelcontextprotocol/den/fix-auth-override

Browse source 
slash-commands: fix PAT auth override silently failing on team checks
This commit is contained in:
Den Delimarsky 2026-03-11 22:49:51 +00:00 • committed by GitHub
commit bd238ed6e4
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 16 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

8
slash-commands/action.yml
View file

@ -99,5 +99,11 @@ runs:
with:
github-token: ${{ inputs.bot-token }}
script: |
// Construct a second Octokit client authed with the PAT for
// org team-membership checks. This has to happen here, not in
// main.js, because @actions/github is only resolvable from
// inside the github-script bundle.
const { getOctokit } = require('@actions/github');
const orgClient = getOctokit(process.env.ORG_TOKEN);
const main = require(process.env.GITHUB_ACTION_PATH + '/main.js');
await main({ github, context, core });
await main({ github, context, core, orgClient });

21
slash-commands/main.js
View file

@ -1,8 +1,8 @@
// Handler for /lgtm, /hold, and /stageblog slash commands. Called by actions/github-script
// via `require(github.action_path + '/main.js')({ github, context, core })`.
// via `require(...)({ github, context, core, orgClient })`.
// See action.yml for input wiring via env vars.
module.exports = async ({ github, context, core }) => {
module.exports = async ({ github, context, core, orgClient }) => {
const { owner, repo } = context.repo;
const approvedLabel = process.env.APPROVED_LABEL;
const holdLabel = process.env.HOLD_LABEL;
@ -13,9 +13,10 @@ module.exports = async ({ github, context, core }) => {
const submitReview = process.env.SUBMIT_REVIEW === 'true';
const reviewMarker = '<!-- slash-commands-lgtm -->';
// `github` is authed with bot-token (defaults to GITHUB_TOKEN) so comments,
// reactions, labels, and reviews show as github-actions[bot]. The PAT is
// passed separately and used ONLY for team-membership checks (read:org).
const orgToken = process.env.ORG_TOKEN;
// reactions, labels, and reviews show as github-actions[bot]. `orgClient`
// is a separate Octokit instance authed with the PAT and used ONLY for
// team-membership checks (read:org). It must be constructed by the caller
// because @actions/github is not resolvable from this file.
function setResult(result, actor) {
core.setOutput('result', result);
@ -80,13 +81,9 @@ module.exports = async ({ github, context, core }) => {
const key = `${teamSlug}:${user}`;
if (teamMembershipCache.has(key)) return teamMembershipCache.get(key);
try {
const { data } = await github.request(
'GET /orgs/{org}/teams/{team_slug}/memberships/{username}',
{
org: owner, team_slug: teamSlug, username: user,
headers: { authorization: `token ${orgToken}` },
},
);
const { data } = await orgClient.rest.teams.getMembershipForUserInOrg({
org: owner, team_slug: teamSlug, username: user,
});
const ok = data.state === 'active';
teamMembershipCache.set(key, ok);
return ok;