"maintain" cannot be used to verify actor permissions
- 主要语言
- JavaScript
- 星标
- 167
- 派生
- 17
- PR 合并指标
- 30 天内没有已合并 PR
描述
### Describe the Issue
The "maintain" permission cannot be used to to verify the actor permissions. As a user with the "maintain" permission I would expect the following configuration to work. However, a comment is created that I only have the "write" permission.
Reading the GH API docs, it clearly states the "permission" field uses legacy base roles and that "maintain" is mapped to "write" [(ref)](https://docs.github.com/en/rest/collaborators/collaborators?apiVersion=2026-03-10#get-repository-permissions-for-a-user). So the output is expected but it is not clearly stated in this Action's documentation. Furthermore, using this legacy permission field of the API prevents us from differentiating between users with the write and users with the maintain role. In our case, we only want maintainers to be able to use the defined command and not developers with the "write" role.
### Action Configuration
```yaml
steps:
- uses: github/command@v2
id: command
with:
command: "/tf-apply"
permissions: maintain,admin
allowed_contexts: pull_request
reaction: "rocket"
skip_ci: true
```
### Relevant Actions Log Output
```
👋 , seems as if you have not maintain/admin permissions in this repo, permissions: write
```
### Extra Information
_No response_
贡献指南
调研方向
从提供的 github/command@v2 配置以及生成所示日志输出的权限检查开始。将 GitHub API 的权限字段与 maintain 和 write 角色进行比较,然后使用提供的 workflow 配置验证行为。完成的标准是能够区分 maintain 用户和 write 用户;如果 API 无法支持这种区分,则需要明确记录这一限制。
由索引模型根据 Issue 内容生成。
评估
- 技术栈
- github-actions, javascript
- 领域
- ci-cd
- Issue 类型
- 功能
- 难度
- 3/5
- 预计耗时
- 1-2 天
- 活跃度
- 冷清
- 描述清晰度
- 基本清楚
- 新手友好度
- 48/100