Ask: Make the AI PR review check tolerate a bot token that cannot create or approve PRs so the review check stops failing whenever the verdict is an approval.
Expected files: .github/workflows/ai-pr-review.yaml
Problem:
The ai-pr-review.yaml workflow runs the reusable misospace/pr-reviewer-action with allow_approve: "true" and verdict_policy: findings_severity_gated. When the reviewer verdict is APPROVE, the action tries to submit a pull-request approval through the generated bot app token. That token does not have the org-level "Allow GitHub Actions to create and approve pull requests" permission (the app is not granted it), so the approval call is rejected and the review step errors out with exit code 1. The results: the standing release-please PR #344 currently shows a failing review check alongside a passing one for the same SHA (the opened/synchronize runs succeed, the labeled/approve run fails), leaving the PR in an UNSTABLE/red state and making CI look non-green on every PR whose review verdict is an approval. The failure text points at "Organization Settings → Actions → Organization permissions → Allow GitHub Actions to create and approve pull requests", i.e. it is a permission/config gap surfaced through this repo workflow.
Evidence:
.github/workflows/ai-pr-review.yaml — allow_approve: "true", verdict_policy: findings_severity_gated, publish_mode: review_verdictgh pr view 344 --json statusCheckRollup → review => FAILURE and review => SUCCESS both present for the same head SHA; mergeStateStatus: UNSTABLEgh run list --branch release-please--branches--main → run 32157609709 failure (job review, step "Review PR with reusable AI reviewer")gh run view 32157609709 --log-failed → "[error]Process completed with exit code 1." after the action attempts to submit an approval
Acceptance:
- On a PR whose review verdict is APPROVE, the
review job completes green (or degrades to a non-blocking comment) instead of erroring.
gh pr view 344 --json statusCheckRollup shows no review => FAILURE for the current head.
Ask: Make the AI PR review check tolerate a bot token that cannot create or approve PRs so the
reviewcheck stops failing whenever the verdict is an approval.Expected files: .github/workflows/ai-pr-review.yaml
Problem:
The
ai-pr-review.yamlworkflow runs the reusablemisospace/pr-reviewer-actionwithallow_approve: "true"andverdict_policy: findings_severity_gated. When the reviewer verdict is APPROVE, the action tries to submit a pull-request approval through the generated bot app token. That token does not have the org-level "Allow GitHub Actions to create and approve pull requests" permission (the app is not granted it), so the approval call is rejected and thereviewstep errors out with exit code 1. The results: the standing release-please PR #344 currently shows a failingreviewcheck alongside a passing one for the same SHA (theopened/synchronizeruns succeed, thelabeled/approve run fails), leaving the PR in anUNSTABLE/red state and making CI look non-green on every PR whose review verdict is an approval. The failure text points at "Organization Settings → Actions → Organization permissions → Allow GitHub Actions to create and approve pull requests", i.e. it is a permission/config gap surfaced through this repo workflow.Evidence:
.github/workflows/ai-pr-review.yaml—allow_approve: "true",verdict_policy: findings_severity_gated,publish_mode: review_verdictgh pr view 344 --json statusCheckRollup→review => FAILUREandreview => SUCCESSboth present for the same head SHA;mergeStateStatus: UNSTABLEgh run list --branch release-please--branches--main→ run 32157609709failure(jobreview, step "Review PR with reusable AI reviewer")gh run view 32157609709 --log-failed→ "[error]Process completed with exit code 1." after the action attempts to submit an approvalAcceptance:
reviewjob completes green (or degrades to a non-blocking comment) instead of erroring.gh pr view 344 --json statusCheckRollupshows noreview => FAILUREfor the current head.