Commit 50a5dd3
fix(ci): use ORG_READ_TOKEN for org membership check in vouch gate (NVIDIA#445)
The GITHUB_TOKEN cannot determine org membership — it lacks read:org
scope and this is not configurable via the permissions block. Both
author_association and orgs.checkMembershipForUser return NONE/404 for
org members (even public ones) when called with the repo-scoped token.
Use an ORG_READ_TOKEN secret (fine-grained PAT with read:org) when
available, falling back to GITHUB_TOKEN. Also restores the
checkCollaborator fallback since the PAT can resolve that too.
Setup required: create a fine-grained PAT with Organization > Members >
Read permission, then add it as a repo secret named ORG_READ_TOKEN.
Co-authored-by: John Myers <johntmyers@users.noreply.github.com>1 parent c377e7a commit 50a5dd3
1 file changed
+28
-14
lines changed| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
16 | 16 | | |
17 | 17 | | |
18 | 18 | | |
| 19 | + | |
19 | 20 | | |
20 | 21 | | |
21 | 22 | | |
| |||
26 | 27 | | |
27 | 28 | | |
28 | 29 | | |
29 | | - | |
30 | | - | |
31 | | - | |
32 | | - | |
33 | | - | |
34 | | - | |
35 | | - | |
| 30 | + | |
| 31 | + | |
| 32 | + | |
| 33 | + | |
36 | 34 | | |
37 | | - | |
| 35 | + | |
| 36 | + | |
| 37 | + | |
| 38 | + | |
| 39 | + | |
| 40 | + | |
| 41 | + | |
| 42 | + | |
| 43 | + | |
| 44 | + | |
| 45 | + | |
| 46 | + | |
| 47 | + | |
| 48 | + | |
| 49 | + | |
| 50 | + | |
| 51 | + | |
38 | 52 | | |
39 | 53 | | |
40 | | - | |
| 54 | + | |
41 | 55 | | |
42 | | - | |
43 | | - | |
44 | | - | |
45 | | - | |
| 56 | + | |
| 57 | + | |
46 | 58 | | |
47 | 59 | | |
48 | 60 | | |
49 | | - | |
| 61 | + | |
| 62 | + | |
| 63 | + | |
50 | 64 | | |
51 | 65 | | |
52 | 66 | | |
| |||
0 commit comments