fix: handle non-user actors (e.g. Copilot) in permission and actor checks

[krislavten]

Summary

GitHub Apps like Copilot SWE Agent set GITHUB_ACTOR to a value (e.g. "Copilot") that is neither a valid GitHub user nor ends with [bot]. This causes two independent crashes in the action:

1. checkWritePermissions (permissions.ts): calls the collaborator permission API → 404 "Copilot is not a user"
2. checkHumanActor (actor.ts): calls octokit.users.getByUsername() → 404 before reaching the allowed_bots check

Root Cause

Both functions assume the actor is either a real GitHub user or a [bot]-suffixed app. Some GitHub Apps (Copilot, and potentially future ones) use a plain name as GITHUB_ACTOR that doesn't match either pattern.

Fix

permissions.ts:

• Check allowed_bots before calling the collaborator API, so known bots skip the API entirely
• Catch "is not a user" 404 errors and fall back to allowed_bots check instead of crashing

actor.ts:

• Move allowed_bots check before the octokit.users.getByUsername() call
• Catch 404 errors and provide a clear error message telling the user to add the bot to allowed_bots

Tests

Added 11 new test cases covering:

• Non-[bot] actor in allowed_bots list (both pre-API and 404 fallback paths)
• Wildcard * for non-[bot] actors
• Non-[bot] actor NOT in allowed_bots (returns false / clear error message)
• Case-insensitive matching
• Non-404 errors still propagate correctly

All 664 existing tests continue to pass.

Closes

• checkHumanActor fails with 404 for bot actors before checking allowed_bots configuration #900 — checkHumanActor fails with 404 before checking allowed_bots
• Title: Support for GitHub Copilot-created Pull Requests #903 — Support for GitHub Copilot-created Pull Requests
• checkWritePermissions fails with 404 for non-user actors like Copilot #1018 — checkWritePermissions fails with 404 for non-user actors
• allowed_bots bypasses actor check but not permission check — bot actors still fail with 404 #1133 — allowed_bots bypasses actor check but not permission check

Related

• Supersedes fix: handle 404 errors in checkWritePermissions for non-user actors #1030 (which only fixed permissions.ts but not actor.ts)

🤖 Generated with Claude Code