🐛 Remove the eyes reaction when analysis finishes - #609
Merged
Conversation
The action added an eyes (👀) reaction on start and a thumbs-up (+1) on finish, but the removal step failed to strip the eyes, leaving both on the PR. The old removal used an unpaginated listForIssue and find(), deleting at most one match — and matched by content only, so it could target another user's reaction (403) and never remove the action's own. putReaction now creates the new reaction first to learn its author from the response (works for the default GITHUB_TOKEN and custom PAT/App tokens alike), then paginates all reactions and deletes only those with the matching content AND authored by that same identity. Other users' reactions are left untouched. Per-item delete errors are tolerated so one failure can't block the rest. Adds unit tests for putReaction covering own-vs-other-user removal, empty oldReaction, missing author, and the non-PR early return. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Ivan Orekhov (ivan-orekhov)
requested a review
from Viktor (tiulpin)
as a code owner
July 17, 2026 09:16
Test files (*.test.ts) are excluded from every tsconfig include and from the composite build, so editors opened them in an inferred project with default compiler options and failed to resolve types (jest globals, imports). This test-only project (noEmit, composite: false) includes src + __tests__ so IDEs type-check the tests properly. It is not part of `tsc -b`, ESLint, or the dist bundle, so build/lint/CI are unaffected. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
AndreiIurko
requested changes
Jul 23, 2026
AndreiIurko
approved these changes
Jul 30, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The action adds an 👀 (
eyes) reaction to the PR when analysis starts and a 👍 (+1) reaction when it finishes. The finish step was supposed to remove the 👀, but it didn't — PRs ended up with both 👀 and 👍.Root cause
putReactioninscan/src/utils.tsremoved the old reaction with an unpaginatedlistForIssue+find(), so:Deleting by
reaction_idalone is also unsafe: GitHub's delete endpoint documents no own-reaction-only restriction, so a naive "delete every match" would strip other users' reactions too.Fix
putReactionnow:user.login) from the response — works for both the defaultGITHUB_TOKEN(github-actions[bot]) and a custom PAT/App token.contentmatches and whose author is that same identity — other users' reactions are left untouched.Tests
Adds
putReactionunit tests: own-vs-other-user removal (a human's 👀 survives), emptyoldReaction, missing author, and the non-PR early return.scan/dist/index.jsregenerated via the pre-commit hook /npm run package.🤖 Generated with Claude Code