github / github/command

"maintain" cannot be used to verify actor permissions

未關閉
#101 0 則留言 0 個 reaction 已指派 0 人 在 GitHub 檢視
bug
主要語言
JavaScript
星號
167
分支
17
PR 合併指標
30 天內沒有已合併 PR

描述

### Describe the Issue

The "maintain" permission cannot be used to to verify the actor permissions. As a user with the "maintain" permission I would expect the following configuration to work. However, a comment is created that I only have the "write" permission.

Reading the GH API docs, it clearly states the "permission" field uses legacy base roles and that "maintain" is mapped to "write" [(ref)](https://docs.github.com/en/rest/collaborators/collaborators?apiVersion=2026-03-10#get-repository-permissions-for-a-user). So the output is expected but it is not clearly stated in this Action's documentation. Furthermore, using this legacy permission field of the API prevents us from differentiating between users with the write and users with the maintain role. In our case, we only want maintainers to be able to use the defined command and not developers with the "write" role.

### Action Configuration

```yaml
steps:
- uses: github/command@v2
id: command
with:
command: "/tf-apply"
permissions: maintain,admin
allowed_contexts: pull_request
reaction: "rocket"
skip_ci: true
```

### Relevant Actions Log Output

```
👋 , seems as if you have not maintain/admin permissions in this repo, permissions: write
```

### Extra Information

_No response_

貢獻指南

開啟貢獻指南

研究方向

從提供的 github/command@v2 設定以及產生所示日誌輸出的權限檢查開始。將 GitHub API 的權限欄位與 maintain 和 write 角色進行比較,然後使用提供的 workflow 設定驗證行為。完成的標準是能夠區分 maintain 使用者和 write 使用者;如果 API 無法支援這種區分,則需要明確記錄這項限制。

由索引模型根據 Issue 內容生成。

評估

技術堆疊
github-actions, javascript
領域
ci-cd
Issue 類型
功能
難度
3/5
預估耗時
1-2 天
活躍度
冷清
描述清晰度
基本清楚
新手友好度
48/100

把新 issue 寄到你的電子郵件信箱

精選適合新手參與的 GitHub issue 摘要。