checkout_pr_branch.cjs fails for Copilot-authored PRs (actor is not a user)

[lpcox]

Problem

assertTrustedCheckoutRuntime() in actions/setup/js/checkout_pr_branch.cjs calls getCollaboratorPermissionLevel with context.actor, which resolves to "Copilot" for Copilot-authored PRs. Since Copilot is an app (not a regular GitHub user), the API returns 404:

GET /repos/github/gh-aw-firewall/collaborators/Copilot/permission - 404
Error: Copilot is not a user

This causes the checkout step to fail for all Copilot-authored PRs.

Failing run

https://github.com/github/gh-aw-firewall/actions/runs/27211514662/job/80359993434?pr=4586

Relevant code

actions/setup/js/checkout_pr_branch.cjs lines 132-136:

const { data: permissionData } = await github.rest.repos.getCollaboratorPermissionLevel({
  owner: context.repo.owner,
  repo: context.repo.repo,
  username: actor,
});

Suggested fix

Handle 404 from the collaborators API for bot/app actors (e.g. Copilot, dependabot[bot]), either by:

1. Catching 404 and treating known trusted app actors as permitted
2. Checking context.payload.sender?.type for "Bot" or "Mannequin" before calling the API

[github-actions]

🏷️ Issue Triaged

Hi @lpcox! I've categorized this issue as bug based on the following analysis:

Reasoning: This issue describes a clear runtime failure — assertTrustedCheckoutRuntime() crashes with a 404 API error when the actor is Copilot (an app, not a user), causing checkout to fail for all Copilot-authored PRs. It includes a failing run URL and a suggested fix, which are hallmarks of a well-documented bug report.

View Triage Details

Analysis

• Keywords detected: fails, 404, Error, causes ... to fail
• Issue type indicators: Reproducible failure with a specific error message and a failing run link; root cause identified; fix proposed
• Confidence: High

Recommended Next Steps

• Implement one of the suggested fixes: catch 404 for bot/app actors, or check context.payload.sender?.type before calling the collaborators API
• Add a regression test covering the Copilot actor case

References: Triage run §27217751757

Generated by 🔧 Issue Triage Agent · 72.3 AIC · ⌖ 12.4 AIC · ⊞ 21.4K · ◷