"maintain" cannot be used to verify actor permissions
- 主要語言
- JavaScript
- 星號
- 167
- 分支
- 17
- PR 合併指標
- 30 天內沒有已合併 PR
描述
### Describe the Issue
The "maintain" permission cannot be used to to verify the actor permissions. As a user with the "maintain" permission I would expect the following configuration to work. However, a comment is created that I only have the "write" permission.
Reading the GH API docs, it clearly states the "permission" field uses legacy base roles and that "maintain" is mapped to "write" [(ref)](https://docs.github.com/en/rest/collaborators/collaborators?apiVersion=2026-03-10#get-repository-permissions-for-a-user). So the output is expected but it is not clearly stated in this Action's documentation. Furthermore, using this legacy permission field of the API prevents us from differentiating between users with the write and users with the maintain role. In our case, we only want maintainers to be able to use the defined command and not developers with the "write" role.
### Action Configuration
```yaml
steps:
- uses: github/command@v2
id: command
with:
command: "/tf-apply"
permissions: maintain,admin
allowed_contexts: pull_request
reaction: "rocket"
skip_ci: true
```
### Relevant Actions Log Output
```
👋 , seems as if you have not maintain/admin permissions in this repo, permissions: write
```
### Extra Information
_No response_
貢獻指南
研究方向
從提供的 github/command@v2 設定以及產生所示日誌輸出的權限檢查開始。將 GitHub API 的權限欄位與 maintain 和 write 角色進行比較,然後使用提供的 workflow 設定驗證行為。完成的標準是能夠區分 maintain 使用者和 write 使用者;如果 API 無法支援這種區分,則需要明確記錄這項限制。
由索引模型根據 Issue 內容生成。
評估
- 技術堆疊
- github-actions, javascript
- 領域
- ci-cd
- Issue 類型
- 功能
- 難度
- 3/5
- 預估耗時
- 1-2 天
- 活躍度
- 冷清
- 描述清晰度
- 基本清楚
- 新手友好度
- 48/100