github / github/command

"maintain" cannot be used to verify actor permissions

未关闭
#101 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看
bug
主要语言
JavaScript
星标
167
派生
17
PR 合并指标
30 天内没有已合并 PR

描述

### Describe the Issue

The "maintain" permission cannot be used to to verify the actor permissions. As a user with the "maintain" permission I would expect the following configuration to work. However, a comment is created that I only have the "write" permission.

Reading the GH API docs, it clearly states the "permission" field uses legacy base roles and that "maintain" is mapped to "write" [(ref)](https://docs.github.com/en/rest/collaborators/collaborators?apiVersion=2026-03-10#get-repository-permissions-for-a-user). So the output is expected but it is not clearly stated in this Action's documentation. Furthermore, using this legacy permission field of the API prevents us from differentiating between users with the write and users with the maintain role. In our case, we only want maintainers to be able to use the defined command and not developers with the "write" role.

### Action Configuration

```yaml
steps:
- uses: github/command@v2
id: command
with:
command: "/tf-apply"
permissions: maintain,admin
allowed_contexts: pull_request
reaction: "rocket"
skip_ci: true
```

### Relevant Actions Log Output

```
👋 , seems as if you have not maintain/admin permissions in this repo, permissions: write
```

### Extra Information

_No response_

贡献指南

打开贡献指南

调研方向

从提供的 github/command@v2 配置以及生成所示日志输出的权限检查开始。将 GitHub API 的权限字段与 maintain 和 write 角色进行比较,然后使用提供的 workflow 配置验证行为。完成的标准是能够区分 maintain 用户和 write 用户;如果 API 无法支持这种区分,则需要明确记录这一限制。

由索引模型根据 Issue 内容生成。

评估

技术栈
github-actions, javascript
领域
ci-cd
Issue 类型
功能
难度
3/5
预计耗时
1-2 天
活跃度
冷清
描述清晰度
基本清楚
新手友好度
48/100

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。