[oakimov]

Summary

threads and the thread lookup post does before publishing called gh with no token. On a Cloud Agent VM that is an anonymous request, which hit the rate limit (HTTP 403, post exit 4).

post, threads, and complete-resolutions.py now choose one credential at the start of the run and send it as GH_TOKEN on every gh call in that process:

• --token-env NAME: the ghp_ or github_pat_ value in that variable. It wins over ambient GH_TOKEN and GITHUB_TOKEN.
• otherwise: one minted GitHub App installation token.

threads accepts --token-env. With neither an App key nor --token-env, the command fails before gh. bind and start are unchanged revision lookups.

The guide's publication paragraph now matches that order: the credential is selected before the first GitHub lookup. complete-resolutions.py on the App path is checked with a different ambient GH_TOKEN.

Tests

bun run typecheck and bun run build passed. bun test: 3413 pass, 0 fail, 13791 expect() calls, 126 files. The fake gh records a SHA-256 of GH_TOKEN for every invocation. The tests check the App path and the --token-env path for threads, the pre-publish lookup, and complete-resolutions.py, including when a different ambient token is set. Token values are not printed.

Hunks to port

Head 416e8bd00f9d9c03865cdade8642c5a127de524f. The script lines below are unchanged from 366b10d.

scripts/review-publish.py:

• 652: _publication_token and _publication_required, next to _hidden_env.
• 789 publisher_env: explicit token, else _publication_token (801), else the hidden --token-env value. All three win over ambient GH_TOKEN / GITHUB_TOKEN. If a publication run is active and the result is still empty (808), exit 4 with No GitHub credential is available. GitHub was not called.
• 1080 begin_publication: call publication_token once and store it.
• 1101 resolve_threads: reuse _publication_token instead of minting again.
• 1725 post: begin_publication before thread_inventory and checked_thread.
• 1766 post_locked: send that same token. Do not mint after the preparatory reads.
• 1967: --token-env is valid for post and threads.
• 2004: threads calls begin_publication before thread_inventory. Put --token-env after the owner/repo/pull positionals; argparse drops those positionals if the option comes first.

scripts/complete-resolutions.py:

• 82: begin_publication before reviews_of, replacing the PAT-only preamble. resolve_threads then uses the same token.

test/review-publish.test.ts: the fake gh appends sha256(GH_TOKEN) or missing to state/call-auth on every invocation. Assertions cover both credentials and reject an anonymous call.

docs/pr-review.md: the publication paragraph selects the credential before the first GitHub lookup, then reads the pull request and the pinned approval again immediately before the send.

  

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The reviewed changes appear safe to merge; both previous findings are addressed.

Summary

post, threads, and complete-resolutions.py select one credential and reuse it for their GitHub calls.

• Review publishing uses one GitHub credential for every lookup and action.

_{Reviews (2) · Last reviewed commit: "Cover App completion reads and correct t..." · Reviewed by Greptile}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!