cli / cli/cli

`gh pr edit --title` fails when a team reviewer is inaccessible to the token

Open
#14,317 1 comment 0 reactions 0 assignees View on GitHub
auth bug gh-pr priority-3
Dominant language
Go
Stars
46.3k
Forks
9k
Avg merge
2d 9h
Merged PRs (30d)
89

Description

### Describe the bug

`gh pr edit --title` can fail before performing the update because its initial pull request lookup fetches `reviewRequests` even though the current reviewers are not needed to replace the title.

This is reproducible when the pull request has a requested team reviewer and the token can update pull requests but cannot resolve that reviewer. The GraphQL response contains the pull request data plus a `FORBIDDEN` error at:

```text
repository.pullRequest.reviewRequests.nodes.0.requestedReviewer
```

This is the same general over-fetching problem previously reported in #8784 for `projectCards`, but the reviewer path remains reproducible in the latest release.

### Affected version

```text
gh version 2.99.0 (2026-09-01)
https://github.com/cli/cli/releases/tag/v2.99.0
```

### Steps to reproduce the behavior

1. Use a token that has permission to write pull requests in an organization repository but cannot resolve a requested team reviewer.
2. Choose a pull request authored by the authenticated user that has a team review request.
3. Run:

```shell
GH_TOKEN="$TOKEN" gh pr edit --repo --title ""
```

4. Observe that the command exits before updating the pull request.

I also reproduced this with `GH_DEBUG=api`. The lookup requested `reviewRequests(first: 100)` and attempted to resolve user, bot, team, and team organization details.

### Expected vs actual behavior

Expected: replacing the title should require only enough pull request data to identify the pull request and print its URL. The command should perform the update without reading reviewers.

Actual: the command exits non-zero while resolving an unrelated team reviewer:

```text
GraphQL: Resource not accessible by personal access token (repository.pullRequest.reviewRequests.nodes.0.requestedReviewer)
```

A query for only the pull request `id` and `url` succeeds with the same token. A locally patched build that uses that minimal lookup also completes the real `PullRequestUpdate` mutation end to end.

### Logs

The sanitized GraphQL error is:

```json
{
"type": "FORBIDDEN",
"path": [
"repository",
"pullRequest",
"reviewRequests",
"nodes",
0,
"requestedReviewer"
],
"extensions": {
"saml_failure": false
},
"locations": [
{
"line": 1,
"column": 211
}
],
"message": "Resource not accessible by personal access token"
}
```

Repository and pull request details have been omitted because the reproduction used a private organization repository.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.