cloudflare-worker: fallback to collaborator permissions check - #70
Open
BKPepe wants to merge 1 commit into
Open
Conversation
GitHub reports author_association CONTRIBUTOR (or NONE) for users whose
organization membership is private, even when they are maintainers with
write access. Those maintainers cannot use the [allow branch] and
[allow cherry-pick] overrides, and their comments do not trigger a
recheck.
Where the association is not enough, ask the repository permission API
(/collaborators/{username}/permission) and accept admin, write or
maintain.
Every answer costs a subrequest, so one resolver memoizes them for the
whole request. Bots and comments without an override command are never
resolved, comments from everyone else are dropped before the pull
request is fetched, and the PR author is resolved only where a bypass
can apply. Lookups stop once the reserved subrequest headroom is
reached. A 404 means the user is not a collaborator, so it is no longer
logged as an API failure.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
BKPepe
force-pushed
the
feature/verify-contributor-maintainer-permission
branch
from
July 26, 2026 07:14
db11546 to
3928240
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
GitHub API returns author_association: CONTRIBUTOR (or NONE) for users whose organization membership is set to private, even if they are repository maintainers with full write/commit access.
When an override command ([allow branch] or [allow cherry-pick]) or PR action is processed and the author's author_association is not OWNER, MEMBER, or COLLABORATOR, fall back to checking GET /repos/{owner}/{repo}/collaborators/{username}/permission.
If the response indicates admin, write, or maintain permission on the repository, treat the user as a maintainer (isMaintainer = true). Results are cached per request invocation to avoid unnecessary API subrequests.