PR Review Agent — failures detected 2026-06-08

[github-actions]

1. Executive Summary

Status: BLOCKING
Period: 2026-06-08T06:59:23Z – 2026-06-08T07:22:51Z
Result: 3 of 35 completed runs failed (8.6%) — all 3 targeting PR #480

Key findings:

• DON_PETRY_BOT_GH_PAT secret holds a fine-grained PAT (github_pat_ prefix); workflow requires a classic PAT — all 3 failures are identical
• All failed runs target the same PR (feat: implement issue #407 — PR Review Agent — failures detected 2026-05-29 #480), which itself modifies pr-review.yml — run #7198 checks out an earlier merge commit with slightly different error messages than #7211/#7212, confirming the PR was iterating on the auth-check code
• 34 cancellations are expected (concurrency group pr-review-pr-<url> — each new same-PR run supersedes the previous); 31 skips are correct (event filter conditions)

Action required: Replace the DON_PETRY_BOT_GH_PAT secret with a classic PAT that has repo + read:org scopes.

---

2. Failure Breakdown

Failure Category	Affected Runs	Example Error Message
Wrong PAT type (fine-grained vs. classic)	#7198, #7211, #7212	Fine-grained PAT detected — this workflow requires a classic PAT.

---

3. Error Patterns

Category: Fine-grained PAT rejection

Exact error (runs #7211, #7212 — newer workflow version on PR #480 head):

##[error]Fine-grained PAT detected — this workflow requires a classic PAT.
##[error]Fine-grained PATs fail at 'gh pr review --approve' (addPullRequestReview).
##[error]Replace DON_PETRY_BOT_GH_PAT with a classic PAT that has 'repo' + 'read:org' scopes.

Exact error (run #7198 — earlier merge commit of PR #480):

##[error]Fine-grained PAT detected — this workflow requires a classic PAT.
##[error]Fine-grained PATs cannot submit pull request reviews (addPullRequestReview is inaccessible).
##[error]Replace DON_PETRY_BOT_GH_PAT with a classic PAT that has repo + read:org scopes.
##[error]See docs/pr-review-agent/setup.md for troubleshooting guidance.

Step: Verify auth scopes (inline run: block in pr-review.yml)
Detection logic: grep -qi 'Token:.*github_pat_' <<< "$auth_status"
Root cause: gh auth status reveals the token starts with github_pat_11CDFSYKQ0w50IHawIgb0w_, which is the format for fine-grained PATs. The GitHub GraphQL addPullRequestReview mutation (used by gh pr review --approve) is not accessible to fine-grained PATs — they cannot submit formal pull request reviews, only comments. The workflow added an explicit early-exit check to surface this clearly rather than fail deep in the review cascade.

---

4. Token Scope Analysis

Token type detected: Fine-grained PAT (github_pat_ prefix) — account donpetry-bot

Status	Scope / Capability	Notes
Present	contents:read	Sufficient for checkout
Present	pull_requests:write (likely)	Fine-grained PRs allow comments
Missing	addPullRequestReview GraphQL access	Fine-grained PATs cannot submit formal reviews (APPROVE / REQUEST_CHANGES) via gh pr review
Missing	read:org equivalent	Fine-grained PATs cannot enumerate org team memberships reliably — gh pr view --json reviewRequests fails on PRs with team reviewers

Recommendation:

• Generate a classic PAT for donpetry-bot with scopes: repo (full) + read:org
• Store it as DON_PETRY_BOT_GH_PAT in the org/repo Actions secrets, replacing the current fine-grained token
• repo covers all repository operations including addPullRequestReview; read:org is required for resolving team-based reviewer requests

---

5. Recommendations

1. Replace DON_PETRY_BOT_GH_PAT with a classic PAT [CRITICAL]

   • What: In GitHub org/repo settings → Secrets → DON_PETRY_BOT_GH_PAT, replace the current github_pat_ fine-grained token with a classic PAT from the donpetry-bot account
   • Required scopes: repo (grants addPullRequestReview) + read:org (grants team-reviewer resolution)
   • Why: Fine-grained PATs cannot call the addPullRequestReview GraphQL mutation; this is a hard GitHub API constraint, not a bug in the workflow
   • Expected impact: All 3 failure categories eliminated; PR feat: implement issue #407 — PR Review Agent — failures detected 2026-05-29 #480 review runs will complete past the auth-check step
   • Urgency: CRITICAL — 100% of review attempts against any PR will fail while this token is misconfigured; the workflow's early-exit check means zero reviews are being submitted

2. Verify PR feat: implement issue #407 — PR Review Agent — failures detected 2026-05-29 #480 is re-triggered after token rotation [HIGH]

   • What: After replacing the secret, manually dispatch pr-review.yml with pr_url=https://github.com/petry-projects/.github-private/pull/480 to confirm the fix
   • Why: PR feat: implement issue #407 — PR Review Agent — failures detected 2026-05-29 #480 has accumulated 3 failed review attempts and the head SHA marker will not have been written; a manual trigger with force_review=true may be needed if an idempotency marker was partially written
   • Expected impact: Confirms the fix and delivers the pending review for PR feat: implement issue #407 — PR Review Agent — failures detected 2026-05-29 #480
   • Urgency: HIGH

3. Audit for other repos using this secret [MEDIUM]

   • What: Check all caller stubs (e.g., pr-review-auto-trigger.yml in other repos) that pass DON_PETRY_BOT_GH_PAT — they all inherit the same broken token
   • Why: The failure is in the shared workflow; any org-wide callers are equally blocked
   • Expected impact: Prevents silent failure in delegated repos once this repo is fixed
   • Urgency: MEDIUM

---

6. Health Score

Health: 7/10 — workflow correctly self-diagnosed a misconfigured PAT type; all failures share a single fixable root cause, and non-PR-#480 runs are succeeding normally.

[don-petry]

Closing stale daily digest — superseded by the newest snapshot. Digest steps now close prior days automatically (#1204 / #1212).