fix: allow Copilot bot in mattpocock-skills-reviewer; handle GitHub App "not a user" in checkBotStatus

actions/setup/js/check_admin_permissions.test.cjs

@@ -133,6 +133,7 @@ describe("check admin permissions for copilot maintenance", () => {
       expect(result).toEqual({
         authorized: false,
         error: "API Error: Not Found",
+        isGitHubApp: false,
       });
 
       expect(mockCore.warning).toHaveBeenCalledWith("Repository permission check failed: API Error: Not Found");
@@ -147,6 +148,7 @@ describe("check admin permissions for copilot maintenance", () => {
       expect(result).toEqual({
         authorized: false,
         error: "Network error: Connection timeout",
+        isGitHubApp: false,
       });
     });
   });

actions/setup/js/check_membership.cjs

@@ -202,7 +202,18 @@ async function main() {
       core.setOutput("is_team_member", "false");
       core.setOutput("result", "api_error");
       core.setOutput("error_message", errorMessage);
-      await writeDenialSummary(errorMessage, "The permission check failed with a GitHub API error. Check the `pre_activation` job log for details.");
+      // When the GitHub API responds with "is not a user", the actor is a GitHub App.
+      // The bot allowlist was either empty or not checked — provide actionable guidance.
+      if (result.isGitHubApp) {
+        await writeDenialSummary(
+          errorMessage,
+          `Actor '${actorToValidate}' is a GitHub App, not a regular user. ` +
+            `To allow this app to trigger the workflow, add it to \`on.bots:\` in the workflow frontmatter. ` +
+            `Example: \`bots: [${actorToValidate}]\``,
+        );
+      } else {
+        await writeDenialSummary(errorMessage, "The permission check failed with a GitHub API error. Check the `pre_activation` job log for details.");
+      }
     } else {
       const errorMessage =
         `Access denied: User '${actorToValidate}' is not authorized. Required permissions: ${requiredPermissions.join(", ")}. ` +

actions/setup/js/check_membership.test.cjs

@@ -701,6 +701,22 @@ describe("check_membership.cjs", () => {
       expect(mockCore.setOutput).toHaveBeenCalledWith("result", "api_error");
     });
 
+    it("should provide actionable guidance when GitHub App actor is not in allowed bots list", async () => {
+      delete process.env.GH_AW_ALLOWED_BOTS;
+      mockContext.actor = "Copilot";
+
+      const notAUserError = { status: 404, message: "Copilot is not a user - https://docs.github.com/rest/collaborators/collaborators#get-repository-permissions-for-a-user" };
+      mockGithub.rest.repos.getCollaboratorPermissionLevel.mockRejectedValue(notAUserError);
+
+      await runScript();
+
+      expect(mockCore.setOutput).toHaveBeenCalledWith("is_team_member", "false");
+      expect(mockCore.setOutput).toHaveBeenCalledWith("result", "api_error");
+      const errorMessageCall = mockCore.setOutput.mock.calls.find(([key]) => key === "error_message");
+      expect(errorMessageCall).toBeDefined();
+      expect(errorMessageCall[1]).toContain("Repository permission check failed");
+    });
+
     it("should authorize a bot with [bot] suffix in the allowlist via slug fallback", async () => {
       process.env.GH_AW_ALLOWED_BOTS = "copilot";
       mockContext.actor = "copilot[bot]";

actions/setup/js/check_permissions_utils.cjs

@@ -154,6 +154,25 @@ function isConfusedDeputyAttack(actor, eventName, payload) {
   return false;
 }
 
+/**
+ * Returns true when a GitHub API 404 error indicates the username refers to a
+ * GitHub App rather than a regular user account.
+ *
+ * The collaborators permission endpoint (`GET /repos/{owner}/{repo}/collaborators/{username}/permission`)
+ * responds with 404 and a message of the form "<login> is not a user" when called
+ * with a GitHub App actor name (e.g. "Copilot").  A plain "Not Found" 404 means
+ * the actor simply doesn't have repository access or doesn't exist.
+ *
+ * @param {unknown} error - The error to inspect
+ * @returns {boolean}
+ */
+function isGitHubAppNotUserError(error) {
+  if (!error || typeof error !== "object") return false;
+  if (!("status" in error) || error.status !== 404) return false;
+  const msg = getErrorMessage(error);
+  return typeof msg === "string" && /\bis not a user\b/.test(msg);
+}
+
 /**
  * Check if the actor is a bot and if it's active on the repository.
  * Accepts both <slug> and <slug>[bot] actor forms, since GitHub Apps
@@ -185,7 +204,16 @@ async function checkBotStatus(actor, owner, repo) {
       core.info(`Bot '${actor}' is active with permission level: ${botPermission.data.permission}`);
       return { isBot: true, isActive: true };
     } catch (botError) {
-      // If we get a 404, the [bot]-suffixed form may not be listed as a collaborator.
+      // If we get a 404 "is not a user" response, GitHub is telling us this is a GitHub
+      // App identity (not a regular user).  GitHub Apps trigger events via their installation,
+      // so if an app actor appears in an event payload it must already have repository access.
+      // Treat it as active to avoid false negatives for apps like Copilot.
+      if (isGitHubAppNotUserError(botError)) {
+        core.info(`Bot '${actor}' is a GitHub App; treating as active based on event trigger`);
+        return { isBot: true, isActive: true };
+      }
+
+      // If we get a plain 404, the [bot]-suffixed form may not be listed as a collaborator.
       // Fall back to checking the non-[bot] (slug) form, as some GitHub Apps appear
       // under their plain slug name rather than the [bot]-suffixed form.
       if (botError?.status === 404) {
@@ -199,6 +227,11 @@ async function checkBotStatus(actor, owner, repo) {
           return { isBot: true, isActive: true };
         } catch (slugError) {
           if (slugError?.status === 404) {
+            // Same "is not a user" check for the slug form fallback.
+            if (isGitHubAppNotUserError(slugError)) {
+              core.info(`Bot '${actor}' is a GitHub App; treating as active based on event trigger`);
+              return { isBot: true, isActive: true };
+            }
             core.warning(`Bot '${actor}' is not active/installed on ${owner}/${repo}`);
             return { isBot: true, isActive: false };
           }
@@ -225,7 +258,7 @@ async function checkBotStatus(actor, owner, repo) {
  * @param {string} owner - Repository owner
  * @param {string} repo - Repository name
  * @param {string[]} requiredPermissions - Array of required permission levels
- * @returns {Promise<{authorized: boolean, permission?: string, error?: string}>}
+ * @returns {Promise<{authorized: boolean, permission?: string, error?: string, isGitHubApp?: boolean}>}
  */
 async function checkRepositoryPermission(actor, owner, repo, requiredPermissions) {
   try {
@@ -254,7 +287,7 @@ async function checkRepositoryPermission(actor, owner, repo, requiredPermissions
   } catch (repoError) {
     const errorMessage = getErrorMessage(repoError);
     core.warning(`Repository permission check failed: ${errorMessage}`);
-    return { authorized: false, error: errorMessage };
+    return { authorized: false, error: errorMessage, isGitHubApp: isGitHubAppNotUserError(repoError) };
   }
 }
 
@@ -263,6 +296,7 @@ module.exports = {
   parseAllowedBots,
   canonicalizeBotIdentifier,
   isAllowedBot,
+  isGitHubAppNotUserError,
   readAllowBotAuthoredTriggerComment,
   isConfusedDeputyAttack,
   checkRepositoryPermission,

actions/setup/js/check_permissions_utils.test.cjs

@@ -264,6 +264,7 @@ describe("check_permissions_utils", () => {
       expect(result).toEqual({
         authorized: false,
         error: "API Error: Not Found",
+        isGitHubApp: false,
       });
 
       expect(mockCore.warning).toHaveBeenCalledWith("Repository permission check failed: API Error: Not Found");
@@ -277,11 +278,25 @@ describe("check_permissions_utils", () => {
       expect(result).toEqual({
         authorized: false,
         error: "String error",
+        isGitHubApp: false,
       });
 
       expect(mockCore.warning).toHaveBeenCalledWith("Repository permission check failed: String error");
     });
 
+    it("should return isGitHubApp: true when the API says the actor is not a user", async () => {
+      const notAUserError = { status: 404, message: "Copilot is not a user - https://docs.github.com/rest/collaborators/collaborators#get-repository-permissions-for-a-user" };
+      mockGithub.rest.repos.getCollaboratorPermissionLevel.mockRejectedValue(notAUserError);
+
+      const result = await checkRepositoryPermission("Copilot", "testowner", "testrepo", ["admin"]);
+
+      expect(result).toEqual({
+        authorized: false,
+        error: "Copilot is not a user - https://docs.github.com/rest/collaborators/collaborators#get-repository-permissions-for-a-user",
+        isGitHubApp: true,
+      });
+    });
+
     it("should check multiple permissions and return true for any match", async () => {
       mockGithub.rest.repos.getCollaboratorPermissionLevel.mockResolvedValue({
         data: { permission: "write" },
@@ -521,6 +536,40 @@ describe("check_permissions_utils", () => {
       expect(mockCore.warning).toHaveBeenCalledWith("Bot 'unknown-app' is not active/installed on testowner/testrepo");
     });
 
+    it("should return active when [bot] form returns 404 'is not a user' (GitHub App like Copilot)", async () => {
+      const notUserError = { status: 404, message: "Copilot[bot] is not a user - https://docs.github.com/rest/collaborators/collaborators#get-repository-permissions-for-a-user" };
+      mockGithub.rest.repos.getCollaboratorPermissionLevel.mockRejectedValue(notUserError);
+
+      const result = await checkBotStatus("Copilot[bot]", "testowner", "testrepo");
+
+      expect(result).toEqual({ isBot: true, isActive: true });
+      expect(mockCore.info).toHaveBeenCalledWith("Bot 'Copilot[bot]' is a GitHub App; treating as active based on event trigger");
+    });
+
+    it("should return active when slug form returns 404 'is not a user' (GitHub App Copilot without [bot] suffix)", async () => {
+      const notFoundError = { status: 404, message: "Not Found" };
+      const notUserError = { status: 404, message: "Copilot is not a user - https://docs.github.com/rest/collaborators/collaborators#get-repository-permissions-for-a-user" };
+      mockGithub.rest.repos.getCollaboratorPermissionLevel
+        .mockRejectedValueOnce(notFoundError) // [bot] form returns plain 404
+        .mockRejectedValueOnce(notUserError); // slug form returns "not a user"
+
+      const result = await checkBotStatus("Copilot", "testowner", "testrepo");
+
+      expect(result).toEqual({ isBot: true, isActive: true });
+      expect(mockCore.info).toHaveBeenCalledWith("Bot 'Copilot' is a GitHub App; treating as active based on event trigger");
+
+      expect(mockGithub.rest.repos.getCollaboratorPermissionLevel).toHaveBeenNthCalledWith(1, {
+        owner: "testowner",
+        repo: "testrepo",
+        username: "Copilot[bot]",
+      });
+      expect(mockGithub.rest.repos.getCollaboratorPermissionLevel).toHaveBeenNthCalledWith(2, {
+        owner: "testowner",
+        repo: "testrepo",
+        username: "Copilot",
+      });
+    });
+
     it("should return inactive with error when slug form returns non-404 error", async () => {
       const notFoundError = { status: 404, message: "Not Found" };
       const rateLimit = new Error("API rate limit exceeded");