PR Review Agent — failures detected 2026-06-04 #428

1. Executive Summary

Status: DEGRADED
Period: 2026-06-04T01:00:00Z – 2026-06-04T05:01:28Z
Result: 3 of 100 runs failed (3%) — all failures share a single root cause

Key findings:

• DON_PETRY_BOT_GH_PAT lacked the repo scope during a burst of runs against PR PR Review Agent: make failure runs diagnosable and harden transient setup failures #353 (01:21–02:05 UTC); subsequent runs on the same PR succeeded, suggesting a temporary token state or rotation
• 25 cancellations are expected and benign — cancel-in-progress: true concurrency drops superseded runs for the same PR
• 2 action_required runs (#4845, #4830) are unresolved and may require manual intervention

Action required: Verify DON_PETRY_BOT_GH_PAT has repo and read:org scopes and, if it is a fine-grained PAT, audit the scope-check script's compatibility with fine-grained PAT auth output format.

2. Failure Breakdown

3. Error Patterns

Category: Missing token scope — repo

Exact error (identical across all 3 runs):

✓ Logged in to github.com account donpetry-bot (GH_TOKEN)
- Active account: true
- Git operations protocol: https
- Token: github_pat_11CDFSYKQ0w50IHawIgb0w_***

##[error]GH_TOKEN is missing required scope: repo
##[error]Process completed with exit code 1.

Step: "Install review engine CLIs" — the scope-validation block that runs before any npm install:

scopes_line="$(printf '%s\n' "$auth_status" | grep 'Token scopes:' || true)"
normalized_scopes="$(printf '%s' "$scopes_line" | sed "s/[',]/ /g")"
required_scopes=(repo read:org)
for required_scope in "${required_scopes[@]}"; do
  if ! grep -qE "(^|[[:space:]])${required_scope}([[:space:]]|$)" <<< "$normalized_scopes"; then
    echo "::error::GH_TOKEN is missing required scope: ${required_scope}"
    exit 1
  fi
done

Root cause (two candidate explanations):

1. Fine-grained PAT incompatibility (most likely). The token prefix github_pat_11CDFSYKQ0w50IHawIgb0w_ identifies it as a GitHub fine-grained PAT. Fine-grained PATs do not expose Token scopes: in gh auth status output the way classic PATs do — they show granular repository/account permissions instead. The grep 'Token scopes:' line returns empty, normalized_scopes is an empty string, and the repo scope check trivially fails even when the token has equivalent permissions.

2. Token temporarily expired or rotated. All 3 failures hit within a ~44-minute window (01:21–02:05 UTC) on the same PR (PR Review Agent: make failure runs diagnosable and harden transient setup failures #353). Run #4816 (02:05:43) succeeded immediately after #4815 failed (02:05:38), suggesting the token was replaced/rotated mid-burst rather than being permanently invalid.

4. Token Scope Analysis

Token in use: DON_PETRY_BOT_GH_PAT → mapped to GH_TOKEN
Token type: Fine-grained PAT (github_pat_ prefix)

Recommendation per scope:

• repo: If DON_PETRY_BOT_GH_PAT is a fine-grained PAT, replace it with a classic PAT that has repo and read:org granted, OR update the scope-check script to handle fine-grained PAT output (which shows repository/account permissions, not Token scopes:). Fine-grained PATs are not supported by all gh CLI scope-detection paths.
• read:org: Same resolution as above. Classic PAT needs read:org; fine-grained PAT needs "Members" read permission on the organization.
• write:discussion / pull-requests: The workflow's permissions: block sets pull-requests: write on the GITHUB_TOKEN — that is separate and appears correct. No change needed there.

5. Recommendations

1. Audit PAT type and replace if fine-grained — scripts/ scope-check block in pr-review.yml (the gh auth status validation inline in "Install review engine CLIs")

   • What: Determine whether DON_PETRY_BOT_GH_PAT is a fine-grained or classic PAT. If fine-grained, either (a) replace with a classic PAT bearing repo + read:org, or (b) update the scope-detection logic to parse fine-grained PAT permission output instead of relying on grep 'Token scopes:'.
   • Why: Fine-grained PATs produce no Token scopes: line; the check always fails regardless of actual permissions.
   • Expected impact: Eliminates all 3 recurring failures; no more false-positive scope rejections.
   • Urgency: CRITICAL — causes 100% failure for any run that hits this code path with a fine-grained PAT.

2. Investigate and resolve action_required runs #4845 and #4830

   • What: Check the Actions UI for pending deployment environment approvals or required review gates on runs #4845 and #4830.
   • Why: action_required status means the workflow is blocked waiting for a human; if left unattended these runs never complete.
   • Expected impact: Clears stalled runs; prevents silent queue backlog if environment protection rules are misconfigured.
   • Urgency: HIGH

3. Pin CLAUDE_CODE_VERSION to a specific semver tag instead of latest

   • What: Set the CLAUDE_CODE_VERSION Actions variable (or hardcode in workflow) to a specific version, e.g., 1.x.y.
   • Why: Cache key claude-code-latest-Linux will serve stale binaries until manually invalidated; a breaking CLI update will be silently picked up on cache miss.
   • Expected impact: Reproducible builds; controlled upgrades.
   • Urgency: MEDIUM

4. Add read:org to the PAT and verify with a dry-run dispatch

   • What: After resolving item test issue from agent #1, trigger a workflow_dispatch with dry_run: true and confirm gh auth status shows both repo and read:org (or equivalent fine-grained permissions) before re-enabling live runs.
   • Why: The scope check exits on the first missing scope — read:org was never evaluated in the failed runs and may also be absent.
   • Expected impact: Prevents a second failure wave after repo is fixed.
   • Urgency: HIGH

6. Health Score

Health: 7/10 — Workflow is largely operational (60% pass rate on active runs) but carries a recurring, fully-preventable auth failure caused by a fine-grained PAT incompatibility with the classical scope-check logic.