fix: treat workflows-scope 403 on branch update as non-fatal; add token fallback for add_comment

.github/workflows/pr-sous-chef.md

@@ -259,7 +259,7 @@ safe-outputs:
   add-comment:
     max: 4
     target: "*"
-    github-token: ${{ secrets.AWI_MAINTENANCE_TOKEN }}
+    github-token: ${{ secrets.AWI_MAINTENANCE_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
   resolve-pull-request-review-thread:
     max: 40
   dismiss-pull-request-review:

actions/setup/js/update_pull_request.cjs

@@ -38,9 +38,12 @@ function isNonFatalUpdateBranchError(error) {
   // Require both permission wording and update-branch context to avoid treating unrelated
   // "workflows permission" errors as non-fatal for pull request branch updates.
   const hasWorkflowsPermissionError = hasWorkflowsPermissionPhrase && (hasWorkflowMutationRefusal || message.includes("update pull request"));
+  // GitHub update-branch API also returns 403 with this message when a PR contains workflow
+  // file changes and the check times out, rather than the usual "refusing to allow" phrase.
+  const hasWorkflowsScopeRequired = message.includes("`workflows` scope may be required") || message.includes("unable to determine if workflow can be created or updated");
 
   if (status !== undefined) {
-    if (status === 403 && hasWorkflowsPermissionError) {
+    if (status === 403 && (hasWorkflowsPermissionError || hasWorkflowsScopeRequired)) {
       return true;
     }
     if (status !== 422) {
@@ -52,7 +55,11 @@ function isNonFatalUpdateBranchError(error) {
   // - already up to date ("There are no new commits on the base branch")
   // - cannot auto-update due to conflict ("merge conflict between base and head")
   // These should not fail safe output processing.
-  return message.includes("there are no new commits on the base branch") || message.includes("merge conflict between base and head") || hasWorkflowsPermissionError;
+  // hasWorkflowsPermissionError / hasWorkflowsScopeRequired are only checked here for errors
+  // with no numeric status (status === undefined). The explicit 403 case is already handled
+  // by the if-block above, and other numeric statuses (e.g. 422 with these phrases) should
+  // not be silently swallowed.
+  return message.includes("there are no new commits on the base branch") || message.includes("merge conflict between base and head") || ((hasWorkflowsPermissionError || hasWorkflowsScopeRequired) && status === undefined);
 }
 
 /**

actions/setup/js/update_pull_request.test.cjs

@@ -941,4 +941,56 @@ describe("update_pull_request.cjs - update_branch behavior", () => {
     });
     expect(mockCore.warning).toHaveBeenCalledWith(expect.stringContaining("branch from base (non-fatal)"));
   });
+
+  it("should continue title/body updates when updateBranch gets workflows-scope-required 403 (scope phrase variant)", async () => {
+    // Message matches only the "`workflows` scope may be required" branch of hasWorkflowsScopeRequired.
+    const scopeError = new Error("Validation failed; `workflows` scope may be required due to timeout in check.");
+    scopeError.status = 403;
+    // The message contains "timeout" which makes isTransientError return true, so withRetry
+    // retries once (maxRetries: 1, see executePRUpdate). Both attempts must fail to reach the
+    // non-fatal catch path. Update this assertion if maxRetries changes.
+    mockGithub.rest.pulls.updateBranch.mockRejectedValue(scopeError);
+
+    const handler = await updatePRModule.main({ update_branch: true });
+    const result = await handler({
+      pull_request_number: 100,
+      title: "Updated PR",
+    });
+
+    expect(result.success).toBe(true);
+    // Called twice: initial attempt + 1 retry (maxRetries: 1 in executePRUpdate)
+    expect(mockGithub.rest.pulls.updateBranch).toHaveBeenCalledTimes(2);
+    expect(mockGithub.rest.pulls.update).toHaveBeenCalledWith({
+      owner: "testowner",
+      repo: "testrepo",
+      pull_number: 100,
+      title: "Updated PR",
+    });
+    expect(mockCore.warning).toHaveBeenCalledWith(expect.stringContaining("branch from base (non-fatal)"));
+  });
+
+  it("should continue title/body updates when updateBranch gets unable-to-determine-workflow 403 (unable-to-determine variant)", async () => {
+    // Message matches only the "unable to determine if workflow can be created or updated" branch
+    // of hasWorkflowsScopeRequired, independently of the scope-phrase variant above.
+    const unableToDetermineError = new Error("Unable to determine if workflow can be created or updated; contact support.");
+    unableToDetermineError.status = 403;
+    // No "timeout" in the message, so isTransientError returns false — no retry, called once.
+    mockGithub.rest.pulls.updateBranch.mockRejectedValueOnce(unableToDetermineError);
+
+    const handler = await updatePRModule.main({ update_branch: true });
+    const result = await handler({
+      pull_request_number: 100,
+      title: "Updated PR",
+    });
+
+    expect(result.success).toBe(true);
+    expect(mockGithub.rest.pulls.updateBranch).toHaveBeenCalledTimes(1);
+    expect(mockGithub.rest.pulls.update).toHaveBeenCalledWith({
+      owner: "testowner",
+      repo: "testrepo",
+      pull_number: 100,
+      title: "Updated PR",
+    });
+    expect(mockCore.warning).toHaveBeenCalledWith(expect.stringContaining("branch from base (non-fatal)"));
+  });
 });