[Eduardo Villalpando Mello (edvilme)]

Summary

Require the PR creator's GitHub account to have repository write, maintain, or admin permission before a version-only PR is accepted as a release candidate. This is the repository's merge-capable role threshold, not a bypass of protected-branch reviews or other merge requirements.

• Run the check in both plan and release modes, after existing candidate validation and before any stable-manifest write or commit. Query permissions again at release time so revoked access is not grandfathered by an earlier plan.
• Use the authenticated repository-permission API, not spoofable Git author names/emails, the workflow actor, or the merger. Accept custom roles through GitHub's reported base permission; no bot exception.
• Fail closed on insufficient/unknown permissions or lookup/authentication failures. Ordinary mixed-file and unchanged-version PRs still skip successfully without an API call.
• Reuse the existing token input. The default github.token has repository metadata read access; custom App/fine-grained tokens need Metadata: read. No organization/team membership permission or new input is needed.

All existing manifest, version, file-mode and create-only push checks remain. No extension changes or publishing activation. Based on main, separately from prefix PR #11.

Validation

• 13 release-action tests and 7 version-action tests passed locally.
• Focused cases cover allowed/rejected roles, PR-creator lookup identity, denial and API failure in both modes before any write, ordinary-PR skips, and existing release behavior.
• Black, Prettier, whitespace, action metadata and Bash syntax checks passed.
• Hosted CI includes Linux/Windows/macOS tests, existing action smoke checks, and a real permission API call using the default github.token. All hosted Linux/Windows/macOS tests, version/release smoke checks, and the real permission lookup with the default github.token passed.

[Eduardo Villalpando Mello (edvilme)]

Copilot resolve the merge conflicts in this pull request

[Copilot]

Copilot resolve the merge conflicts in this pull request

Resolved the conflicts while preserving both changesets and merged main in commit 4dd3ee9. The release and version action test suites pass.

[Rich Chiodo (rchiodo)]

🔒 Automated review in progress — Rich Chiodo (@rchiodo) is auto-reviewing this PR.

[Copilot]

🟢 Approval recommended

No active review issues remain for the release-action permission gate.

No open issues 🎉

What changed in this PR

This PR adds a live repository-permission check to the release action, requiring the PR creator to have write, maintain, or admin access before a release candidate proceeds in either mode.

Changes:

• Checks author permissions before stable-manifest preparation, rejecting insufficient access or lookup failures while preserving ordinary-PR skips.
• Adds tests for allowed roles, creator identity, rejection before writes, and authorization skips.
• Documents token requirements and adds a real permission-API smoke check using github.token.

File	Description
actions/​release-pr/​tests/​test_release_pr.py	Adds mocked permission checks and coverage for authorization behavior in both modes.
actions/​release-pr/​README.md	Documents author eligibility, live checks, CLI availability, and token requirements.
actions/​release-pr/​action.yml	Adds the fail-closed PR-creator permission gate after candidate validation.
.github/​workflows/​smoke-release-pr-action.yml	Verifies permission lookup with the default action token.

_{Review effort: Balanced}

[Rich Chiodo (rchiodo)]

Reviewed commit: 4dd3ee9785c5c7cf1ea53712c32de473f76467c0

Result: ⚠️ partially-verified

Verification details

Verification: Automated verification is best effort. The PR author remains responsible for testing.

Summary: All 22 targeted tests passed in the Linux container: 15 release-action tests and 7 version-action tests. Coverage includes allowed/rejected permissions, fail-closed API errors before writes in both modes, and ordinary-PR authorization skips. Additional checks passed for identity/token wiring, step ordering, and Bash syntax. No failures occurred, but the live GitHub permission lookup and Windows/macOS runs remain unverified. **Reviewer dependency follow-up (nonblocking):** Suggest a separate PR adding `GitHub CLI (gh; no version constraint declared)` to the official reviewer dependency declarations, using `actions/release-pr/README.md` as the dependency/version evidence. Do not automatically create that PR. This is reviewer environment maintenance, not a required change to the reviewed PR.

Test runs: 4 passed, 2 not run

• ⚠️ Not run | Live permission lookup with the action token | gh api "repos/$REPOSITORY/collaborators/$AUTHOR/permission" --jq .permission
• ⚠️ Not run | Windows and macOS test matrix | python -m unittest discover -s actions/get-extension-version/tests -v
python -m unittest discover -s actions/release-pr/tests -v
• ✅ Passed | Release-action tests | python -m unittest discover -s actions/release-pr/tests -v
• ✅ Passed | Version-action tests | python -m unittest discover -s actions/get-extension-version/tests -v
• ✅ Passed | Dependency and targeted-test discovery | printf 'AUTOMATION_SANDBOX_PROFILE=%s\n' "${AUTOMATION_SANDBOX_PROFILE:-unset}"; uname -s; python --version; git --version; bash --version | head -n 1; command -v gh || true; python - <<'PY'
import ast
import importlib.util
import pathlib
import shutil
import sys
print('Selected interpreter:', sys.executable)
for tool in ('git', 'bash', 'gh'):
print(f'{tool}: {shutil.which(tool)}')
for directory in ('actions/release-pr', 'actions/get-extension-version'):
root = pathlib.Path(directory)
print(f'\n{directory} test discovery:')
for path in sorted((root / 'tests').glob('test*.py')):
tree = ast.parse(path.read_text(encoding='utf-8'))
tests = [node.name for node in ast.walk(tree) if isinstance(node, ast.FunctionDef) and node.name.startswith('test_')]
print(f'{path}: {len(tests)} tests')
for name in tests:
print(' ', name)
for filename in ('pyproject.toml', 'uv.lock', 'requirements.txt', 'package.json'):
path = root / filename
if path.exists():
print('Dependency metadata:', path)
print('\nPyYAML available:', importlib.util.find_spec('yaml') is not None)
PY
• ✅ Passed | Action wiring and Bash syntax checks | python - <<'PY'
from pathlib import Path
import subprocess
import yaml

action = yaml.safe_load(Path('actions/release-pr/action.yml').read_text())
workflow = yaml.safe_load(Path('.github/workflows/smoke-release-pr-action.yml').read_text())
steps = action['runs']['steps']
by_name = {step['name']: step for step in steps}
auth = by_name['Check release author permissions']
assert auth['if'] == "steps.validate.outputs.version != ''"
assert auth['env'] == {
'GH_TOKEN': '${{ inputs.token }}',
'GH_HOST': 'github.com',
'REPOSITORY': '${{ github.repository }}',
'AUTHOR': '${{ github.event.pull_request.user.login }}',
}
assert 'mode' not in auth['if']
names = [step['name'] for step in steps]
assert names.index('Validate the manifest change') < names.index('Check release author permissions')
for name in ('Calculate the stable version', 'Prepare the stable manifest', 'Stage the stable manifest', 'Commit the stable manifest', 'Push the finished release branch'):
assert names.index('Check release author permissions') < names.index(name)
assert action['inputs']['token']['default'] == '${{ github.token }}'
smoke = next(step for step in workflow['jobs']['smoke']['steps'] if step.get('name') == 'Verify repository permission lookup with the action token')
assert smoke['env'] == {**auth['env'], 'GH_TOKEN': '${{ github.token }}'}
assert smoke['run'] in auth['run']
print('PASS: PR-creator identity, token/host/repository wiring, candidate-only gate in both modes, authorization before writes, and smoke API command match')
count = 0
for group in [steps] + [job['steps'] for job in workflow['jobs'].values()]:
for step in group:
if 'run' in step:
subprocess.run(['bash', '-n'], input=step['run'], text=True, check=True)
count += 1
print(f'PASS: Bash syntax for {count} action/workflow run steps')
print('Platform matrix:', workflow['jobs']['tests']['strategy']['matrix']['os'])
PY

⚠️ Live permission lookup with the action token diagnostic output

Discovery selected /usr/local/bin/python (Python 3.13.17) in the generic Linux container and reported gh: None. actions/release-pr/README.md:152 requires GitHub CLI, without a version constraint. No setup attempted: no supported offline gh preparation is declared; the credential-free container also cannot perform the authenticated GitHub request. Mocked permission tests passed, but do not validate GitHub token access.

⚠️ Windows and macOS test matrix diagnostic output

.github/workflows/smoke-release-pr-action.yml configures ubuntu-latest, windows-latest, and macos-latest. Discovery reported Linux; Windows and macOS execution environments were unavailable. Both suites passed on Linux.

[Rich Chiodo (rchiodo)]

Approved via Review Center.