@e2e-dev/github 0.4.1-nightly-20261015074742 → 0.4.2-nightly-20261016073603

package/dist/.build.json

@@ -1 +1 @@
-{"version":"0.4.1-nightly-20261015074742"}
+{"version":"0.4.2-nightly-20261016073603"}

package/dist/post.d.ts

@@ -1,8 +1,8 @@
 /**
  * One comment per pull request, kept current: the reporter looks for the
- * comment whose first line is its marker and edits it, and creates one only
- * when none exists. The REST calls are the three GitHub documents them as: list the
- * issue's comments, update a comment, create a comment.
+ * comment the token's own account wrote whose first line is its marker and
+ * edits it, and creates one only when none exists. The REST calls are the ones GitHub documents: read the token's
+ * account, list the issue's comments, update a comment, create a comment.
  *
  * Every request carries the reporter's abort signal. Anything GitHub answers
  * outside the protocol is an error naming itself; the runner prints one line.

package/dist/post.js

@@ -1,8 +1,8 @@
 /**
  * One comment per pull request, kept current: the reporter looks for the
- * comment whose first line is its marker and edits it, and creates one only
- * when none exists. The REST calls are the three GitHub documents them as: list the
- * issue's comments, update a comment, create a comment.
+ * comment the token's own account wrote whose first line is its marker and
+ * edits it, and creates one only when none exists. The REST calls are the ones GitHub documents: read the token's
+ * account, list the issue's comments, update a comment, create a comment.
  *
  * Every request carries the reporter's abort signal. Anything GitHub answers
  * outside the protocol is an error naming itself; the runner prints one line.
@@ -16,9 +16,11 @@ const PER_PAGE = 100;
  */
 const MAX_PAGES = 100;
 const USER_AGENT = '@e2e-dev/github';
-/** One GitHub REST call; anything but success is an error the runner can print. */
-async function request(params, method, route, body) {
-    const response = await params.fetch(`${params.apiUrl}${route}`, {
+/** What GitHub answers `GET /user` with for an installation token: `GITHUB_TOKEN` or a GitHub App's. */
+const INTEGRATION_REFUSAL = 'Resource not accessible by integration';
+/** Sends one GitHub REST call and hands back the response as it came. */
+function send(params, method, route, body) {
+    return params.fetch(`${params.apiUrl}${route}`, {
         method,
         headers: {
             authorization: `Bearer ${params.token}`,
@@ -30,15 +32,50 @@ async function request(params, method, route, body) {
         ...(body === undefined ? {} : { body: JSON.stringify(body) }),
         signal: params.signal,
     });
-    if (response.ok)
-        return response.json().catch(() => undefined);
+}
+/** The error for a response the protocol has no meaning for, with the start of its body. */
+async function unexpected(response, method, route) {
     const detail = (await response.text().catch(() => '')).slice(0, 200);
+    return new Error(`GitHub responded ${response.status} to ${method} ${route}${detail === '' ? '' : `: ${detail}`}`);
+}
+/** The error the runner prints for a response that is not a success. */
+async function failure(params, response, method, route) {
     if (response.status === 401)
-        throw new Error('GitHub rejected the token (GITHUB_TOKEN or GH_TOKEN)');
+        return new Error('GitHub rejected the token (GITHUB_TOKEN or GH_TOKEN)');
     if (response.status === 403 || response.status === 404) {
-        throw new Error(`the token cannot comment on ${params.repository}#${params.pullRequest}: a pull request from a fork runs with a read-only token, and the job needs \`permissions: pull-requests: write\``);
+        return new Error(`the token cannot comment on ${params.repository}#${params.pullRequest}: a pull request from a fork runs with a read-only token, and the job needs \`permissions: pull-requests: write\``);
     }
-    throw new Error(`GitHub responded ${response.status} to ${method} ${route}${detail === '' ? '' : `: ${detail}`}`);
+    return unexpected(response, method, route);
+}
+/** One GitHub REST call; anything but success is an error the runner can print. */
+async function request(params, method, route, body) {
+    const response = await send(params, method, route, body);
+    if (response.ok)
+        return response.json().catch(() => undefined);
+    throw await failure(params, response, method, route);
+}
+/**
+ * The account the token posts as. A personal token names its user at
+ * `GET /user`. An installation token cannot read it, and posts as its app's
+ * bot, `github-actions[bot]` or `<app>[bot]`, so any bot author matches.
+ */
+async function tokenAuthor(params) {
+    const response = await send(params, 'GET', '/user');
+    if (response.ok) {
+        const user = await response.json().catch(() => undefined);
+        if (!isRecord(user) || typeof user['login'] !== 'string')
+            throw new Error('GitHub answered GET /user without a login');
+        const login = user['login'].toLowerCase();
+        return (author) => typeof author['login'] === 'string' && author['login'].toLowerCase() === login;
+    }
+    if (response.status === 403) {
+        const refusal = await response.clone().json().catch(() => undefined);
+        if (isRecord(refusal) && refusal['message'] === INTEGRATION_REFUSAL)
+            return (author) => author['type'] === 'Bot';
+    }
+    if (response.status === 401)
+        throw await failure(params, response, 'GET', '/user');
+    throw await unexpected(response, 'GET', '/user');
 }
 /**
  * Whether a comment body is the reporter's own for this marker: its first
@@ -51,13 +88,17 @@ function carriesMarker(body, marker) {
     const firstLine = end === -1 ? body : body.slice(0, end);
     return firstLine.replace(/\r$/, '') === marker;
 }
-/** The id of the comment carrying the marker, or undefined when no page has one. */
-async function findComment(params, issue) {
+/** The id of the comment the author wrote carrying the marker, or undefined when no page has one. */
+async function findComment(params, issue, author) {
     for (let page = 1; page <= MAX_PAGES; page += 1) {
         const comments = await request(params, 'GET', `${issue}/comments?per_page=${PER_PAGE}&page=${page}`);
         if (!Array.isArray(comments))
             throw new Error('GitHub answered the comment list with a body that is not a list');
-        const found = comments.find((comment) => isRecord(comment) && typeof comment['body'] === 'string' && carriesMarker(comment['body'], params.marker));
+        const found = comments.find((comment) => isRecord(comment) &&
+            isRecord(comment['user']) &&
+            author(comment['user']) &&
+            typeof comment['body'] === 'string' &&
+            carriesMarker(comment['body'], params.marker));
         if (isRecord(found) && typeof found['id'] === 'number')
             return found['id'];
         if (comments.length < PER_PAGE)
@@ -68,7 +109,7 @@ async function findComment(params, issue) {
 /** Creates or updates the reporter's comment and resolves with its URL. */
 export async function upsertComment(params) {
     const issue = `/repos/${params.repository}/issues/${params.pullRequest}`;
-    const existing = await findComment(params, issue);
+    const existing = await findComment(params, issue, await tokenAuthor(params));
     const created = existing === undefined
         ? await request(params, 'POST', `${issue}/comments`, { body: params.body })
         : await request(params, 'PATCH', `/repos/${params.repository}/issues/comments/${existing}`, { body: params.body });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@e2e-dev/github",
-  "version": "0.4.1-nightly-20261015074742",
+  "version": "0.4.2-nightly-20261016073603",
   "description": "GitHub reporter for e2e: one pull request comment per run, from GitHub Actions",
   "keywords": [
     "e2e",
@@ -43,10 +43,10 @@
     "NOTICE"
   ],
   "peerDependencies": {
-    "e2e": "0.21.1-nightly-20261015074742"
+    "e2e": "0.21.2-nightly-20261016073603"
   },
   "devDependencies": {
-    "e2e": "0.21.1-nightly-20261015074742",
+    "e2e": "0.21.2-nightly-20261016073603",
     "@types/node": "26.6.2",
     "typescript": "7.0.2",
     "vitest": "5.0.1"