fix(ci): use ORG_READ_TOKEN for org membership check in vouch gate#445
Merged
johntmyers merged 1 commit intomainfrom Mar 18, 2026
Merged
fix(ci): use ORG_READ_TOKEN for org membership check in vouch gate#445johntmyers merged 1 commit intomainfrom
johntmyers merged 1 commit intomainfrom
Conversation
The GITHUB_TOKEN cannot determine org membership — it lacks read:org scope and this is not configurable via the permissions block. Both author_association and orgs.checkMembershipForUser return NONE/404 for org members (even public ones) when called with the repo-scoped token. Use an ORG_READ_TOKEN secret (fine-grained PAT with read:org) when available, falling back to GITHUB_TOKEN. Also restores the checkCollaborator fallback since the PAT can resolve that too. Setup required: create a fine-grained PAT with Organization > Members > Read permission, then add it as a repo secret named ORG_READ_TOKEN.
Collaborator
I don't see |
2 tasks
drew
pushed a commit
that referenced
this pull request
Mar 18, 2026
) The GITHUB_TOKEN cannot determine org membership — it lacks read:org scope and this is not configurable via the permissions block. Both author_association and orgs.checkMembershipForUser return NONE/404 for org members (even public ones) when called with the repo-scoped token. Use an ORG_READ_TOKEN secret (fine-grained PAT with read:org) when available, falling back to GITHUB_TOKEN. Also restores the checkCollaborator fallback since the PAT can resolve that too. Setup required: create a fine-grained PAT with Organization > Members > Read permission, then add it as a repo secret named ORG_READ_TOKEN. Co-authored-by: John Myers <johntmyers@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
GITHUB_TOKENfundamentally cannot determine org membership —read:orgis not a configurable scope for it. Bothauthor_association(via REST API) andorgs.checkMembershipForUserreturnNONE/404 for org members when called with the repo-scoped token.ORG_READ_TOKENsecret when available, falling back toGITHUB_TOKENKh4LtoVOUCHED.tdon thevouchedbranch as an interim workaround so fix(sandbox): rotate openshell.log daily, keep 3 files #431 can be reopened nowRelated Issue
Follow-up to #442 and #444. Fixes the false positive closing of #430 / #431.
Changes
.github/workflows/vouch-check.yml:ORG_READ_TOKEN(withGITHUB_TOKENfallback) viagithub-tokentoactions/github-scriptorgs.checkMembershipForUserandrepos.checkCollaboratorchecks — they work correctly with a token that hasread:orgSetup Required
Create a fine-grained PAT (or classic PAT) with Organization > Members > Read (
read:org) permission, then add it as a repo secret namedORG_READ_TOKEN.Until that secret exists, the workflow falls back to
GITHUB_TOKENand org members will need to be inVOUCHED.tdto bypass the gate.Testing
GITHUB_TOKENreturnsauthor_association=NONEfor org member Kh4L (run 23254861242)gh api(withread:orgtoken) that the same endpoint returnsMEMBERKh4Ladded toVOUCHED.tdfor immediate unblockingChecklist