fix(ci): support integration tokens in comment upsert

Author: yiliang114

.github/actions/post-coverage-comment/action.yml

@@ -109,6 +109,7 @@ runs:
         ${{ always() }}
       shell: 'bash'
       env:
+        BOT_LOGIN: 'github-actions[bot]'
         GH_TOKEN: '${{ inputs.github_token }}'
         PR_NUMBER: '${{ github.event.pull_request.number }}'
         REPOSITORY: '${{ github.repository }}'

.github/scripts/upsert-bot-comment.sh

@@ -17,6 +17,9 @@
 # path), never the no-op success reserved for a lookup that genuinely
 # found nothing.
 #
+# Set BOT_LOGIN when the token cannot access the /user endpoint, such as a
+# GitHub Actions integration token.
+#
 # Usage: upsert-bot-comment.sh <owner/repo> <issue-number> <marker> <body-file> [--update-only]
 #   --update-only: PATCH an existing bot-authored marker comment if present;
 #                  succeed as a no-op when none exists (never POSTs). For
@@ -33,7 +36,8 @@ update_only="${5:-}"
 body="$(cat "${body_file}")"
 
 for _attempt in 1 2 3; do
-  if bot_login="$(gh api user --jq '.login')" \
+  if bot_login="${BOT_LOGIN:-}" \
+    && { [ -n "${bot_login}" ] || bot_login="$(gh api user --jq '.login')"; } \
     && [ -n "${bot_login}" ] \
     && listing="$(gh api "repos/${repo}/issues/${number}/comments" \
       --method GET \

.github/scripts/upsert-bot-comment.test.mjs

@@ -31,7 +31,7 @@ const here = dirname(fileURLToPath(import.meta.url));
 const script = join(here, 'upsert-bot-comment.sh');
 const MARKER = '<!-- test-marker -->';
 
-function run(scenario, { updateOnly = false } = {}) {
+function run(scenario, { updateOnly = false, botLogin = '' } = {}) {
   const dir = mkdtempSync(join(tmpdir(), 'upsert-bot-comment-'));
   const bin = join(dir, 'bin');
   mkdirSync(bin);
@@ -93,6 +93,7 @@ function run(scenario, { updateOnly = false } = {}) {
           PATH: `${bin}:${process.env.PATH}`,
           SCENARIO: scenario,
           CALLS: calls,
+          BOT_LOGIN: botLogin,
         },
       },
     );
@@ -112,6 +113,13 @@ test('POSTs a fresh comment when no bot-authored marker exists', () => {
   assert.doesNotMatch(r.calls, /--method PATCH/);
 });
 
+test('uses BOT_LOGIN when the token cannot access /user', () => {
+  const r = run('user-fails', { botLogin: 'bot' });
+  assert.equal(r.code, 0);
+  assert.match(r.stdout, /posted new comment/);
+  assert.doesNotMatch(r.calls, /api user/);
+});
+
 test('PATCHes the existing bot-authored marker comment', () => {
   const r = run('existing-bot');
   assert.equal(r.code, 0);