Hacktoberfest 2026:维护者为十月标记出来的 issue,仍然开放、适合新手。 浏览 Hacktoberfest issue

`gh pr edit --title` fails when a team reviewer is inaccessible to the token

未关闭
#14,317 1 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

还没有人认领这个 Issue。

评估

难度
3/5
预计耗时
1-2 天
新手友好度
68/100
Issue 类型
缺陷
描述清晰度
基本清楚
活跃度
活跃
技术栈
github, go
领域
api, cli

调研方向

从 gh pr edit 命令开始,跟踪 PullRequestUpdate mutation 之前对 pull request 的初始查找。使用提供的 team-reviewer 和 limited-token 复现来验证,标题替换不再读取 reviewRequests,同时更新仍能完成。完成标准是标题发生更改,不再出现被禁止的 reviewer 错误,并且现有测试通过。

由索引模型根据 Issue 内容生成。

描述

auth bug gh-pr priority-3
Describe the bug

gh pr edit --title can fail before performing the update because its initial pull request lookup fetches reviewRequests even though the current reviewers are not needed to replace the title.

This is reproducible when the pull request has a requested team reviewer and the token can update pull requests but cannot resolve that reviewer. The GraphQL response contains the pull request data plus a FORBIDDEN error at:

repository.pullRequest.reviewRequests.nodes.0.requestedReviewer

This is the same general over-fetching problem previously reported in #8784 for projectCards, but the reviewer path remains reproducible in the latest release.

Affected version
gh version 2.99.0 (2026-09-01)
https://github.com/cli/cli/releases/tag/v2.99.0
Steps to reproduce the behavior
  1. Use a token that has permission to write pull requests in an organization repository but cannot resolve a requested team reviewer.

  2. Choose a pull request authored by the authenticated user that has a team review request.

  3. Run:

    GH_TOKEN="$TOKEN" gh pr edit <number> --repo <owner/repo> --title "<current title>"
    
  4. Observe that the command exits before updating the pull request.

I also reproduced this with GH_DEBUG=api. The lookup requested reviewRequests(first: 100) and attempted to resolve user, bot, team, and team organization details.

Expected vs actual behavior

Expected: replacing the title should require only enough pull request data to identify the pull request and print its URL. The command should perform the update without reading reviewers.

Actual: the command exits non-zero while resolving an unrelated team reviewer:

GraphQL: Resource not accessible by personal access token (repository.pullRequest.reviewRequests.nodes.0.requestedReviewer)

A query for only the pull request id and url succeeds with the same token. A locally patched build that uses that minimal lookup also completes the real PullRequestUpdate mutation end to end.

Logs

The sanitized GraphQL error is:

{
  "type": "FORBIDDEN",
  "path": [
    "repository",
    "pullRequest",
    "reviewRequests",
    "nodes",
    0,
    "requestedReviewer"
  ],
  "extensions": {
    "saml_failure": false
  },
  "locations": [
    {
      "line": 1,
      "column": 211
    }
  ],
  "message": "Resource not accessible by personal access token"
}

Repository and pull request details have been omitted because the reproduction used a private organization repository.

主要语言
Go
星标
46.3k
派生
9.1k
平均合并
1 天 7 小时
30 天内合并 PR
76

贡献指南

打开贡献指南

从这里开始

  1. 先读完整个 Issue,再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库,在一个分支上完成修改。
  4. 提交 Pull Request,并在描述里引用这个 Issue 编号。

cli/cli 的其他 Issue

查看 cli/cli 的全部 Issue

相似的 Issue

更多 Go Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。