Add ignored-roles field to rate-limit configuration with defaults

actions/setup/js/check_rate_limit.cjs

@@ -35,11 +35,42 @@ async function main() {
   const maxRuns = parseInt(process.env.GH_AW_RATE_LIMIT_MAX || "5", 10);
   const windowMinutes = parseInt(process.env.GH_AW_RATE_LIMIT_WINDOW || "60", 10);
   const eventsList = process.env.GH_AW_RATE_LIMIT_EVENTS || "";
+  // Default: admin, maintain, and write roles are exempt from rate limiting
+  const ignoredRolesList = process.env.GH_AW_RATE_LIMIT_IGNORED_ROLES || "admin,maintain,write";
 
   core.info(`🔍 Checking rate limit for user '${actor}' on workflow '${workflowId}'`);
   core.info(`   Configuration: max=${maxRuns} runs per ${windowMinutes} minutes`);
   core.info(`   Current event: ${eventName}`);
 
+  // Check if user has an ignored role (exempt from rate limiting)
+  const ignoredRoles = ignoredRolesList.split(",").map(r => r.trim());
+  core.info(`   Ignored roles: ${ignoredRoles.join(", ")}`);
+
+  try {
+    // Check user's permission level in the repository
+    const { data: permissionData } = await github.rest.repos.getCollaboratorPermissionLevel({
+      owner,
+      repo,
+      username: actor,
+    });
+
+    const userPermission = permissionData.permission;
+    core.info(`   User '${actor}' has permission level: ${userPermission}`);
+
+    // Map GitHub permission levels to role names
+    // GitHub uses: admin, maintain, write, triage, read
+    if (ignoredRoles.includes(userPermission)) {
+      core.info(`✅ User '${actor}' has ignored role '${userPermission}'; skipping rate limit check`);
+      core.setOutput("rate_limit_ok", "true");
+      return;
+    }
+  } catch (error) {
+    // If we can't check permissions, continue with rate limiting (fail-secure)
+    const errorMsg = error instanceof Error ? error.message : String(error);
+    core.warning(`⚠️ Could not check user permissions: ${errorMsg}`);
+    core.warning(`   Continuing with rate limit check for user '${actor}'`);
+  }
+
   // Parse events to apply rate limiting to
   const limitedEvents = eventsList ? eventsList.split(",").map(e => e.trim()) : [];
 

actions/setup/js/check_rate_limit.test.cjs

@@ -48,6 +48,10 @@ describe("check_rate_limit", () => {
     delete process.env.GH_AW_RATE_LIMIT_MAX;
     delete process.env.GH_AW_RATE_LIMIT_WINDOW;
     delete process.env.GH_AW_RATE_LIMIT_EVENTS;
+    delete process.env.GH_AW_RATE_LIMIT_IGNORED_ROLES;
+
+    // Reset repos mock
+    mockGithub.rest.repos = undefined;
 
     // Reload the module to get fresh instance
     vi.resetModules();
@@ -558,4 +562,161 @@ describe("check_rate_limit", () => {
 
     expect(mockCore.info).toHaveBeenCalledWith(expect.stringContaining("Using workflow name: test-workflow (fallback"));
   });
+
+  it("should use default ignored roles (admin, maintain, write) when not specified", async () => {
+    // Don't set GH_AW_RATE_LIMIT_IGNORED_ROLES, so it uses default
+
+    // Mock the permission check to return write
+    mockGithub.rest.repos = {
+      getCollaboratorPermissionLevel: vi.fn().mockResolvedValue({
+        data: {
+          permission: "write",
+        },
+      }),
+    };
+
+    await checkRateLimit.main();
+
+    expect(mockCore.info).toHaveBeenCalledWith(expect.stringContaining("Ignored roles: admin, maintain, write"));
+    expect(mockCore.info).toHaveBeenCalledWith(expect.stringContaining("User 'test-user' has permission level: write"));
+    expect(mockCore.info).toHaveBeenCalledWith(expect.stringContaining("User 'test-user' has ignored role 'write'; skipping rate limit check"));
+    expect(mockCore.setOutput).toHaveBeenCalledWith("rate_limit_ok", "true");
+    expect(mockGithub.rest.actions.listWorkflowRuns).not.toHaveBeenCalled();
+  });
+
+  it("should apply rate limiting to triage users by default", async () => {
+    // Don't set GH_AW_RATE_LIMIT_IGNORED_ROLES, so it uses default (admin, maintain, write)
+
+    mockGithub.rest.repos = {
+      getCollaboratorPermissionLevel: vi.fn().mockResolvedValue({
+        data: {
+          permission: "triage",
+        },
+      }),
+    };
+
+    mockGithub.rest.actions = {
+      listWorkflowRuns: vi.fn().mockResolvedValue({
+        data: {
+          workflow_runs: [],
+        },
+      }),
+      cancelWorkflowRun: vi.fn(),
+    };
+
+    await checkRateLimit.main();
+
+    expect(mockCore.info).toHaveBeenCalledWith(expect.stringContaining("Ignored roles: admin, maintain, write"));
+    expect(mockCore.info).toHaveBeenCalledWith(expect.stringContaining("User 'test-user' has permission level: triage"));
+    expect(mockGithub.rest.actions.listWorkflowRuns).toHaveBeenCalled();
+    expect(mockCore.setOutput).toHaveBeenCalledWith("rate_limit_ok", "true");
+  });
+
+  it("should skip rate limiting for users with ignored roles", async () => {
+    process.env.GH_AW_RATE_LIMIT_IGNORED_ROLES = "admin,maintain";
+
+    // Mock the permission check to return admin
+    mockGithub.rest.repos = {
+      getCollaboratorPermissionLevel: vi.fn().mockResolvedValue({
+        data: {
+          permission: "admin",
+        },
+      }),
+    };
+
+    await checkRateLimit.main();
+
+    expect(mockCore.info).toHaveBeenCalledWith(expect.stringContaining("Ignored roles: admin, maintain"));
+    expect(mockCore.info).toHaveBeenCalledWith(expect.stringContaining("User 'test-user' has permission level: admin"));
+    expect(mockCore.info).toHaveBeenCalledWith(expect.stringContaining("User 'test-user' has ignored role 'admin'; skipping rate limit check"));
+    expect(mockCore.setOutput).toHaveBeenCalledWith("rate_limit_ok", "true");
+    expect(mockGithub.rest.actions.listWorkflowRuns).not.toHaveBeenCalled();
+  });
+
+  it("should skip rate limiting for users with maintain permission when in ignored roles", async () => {
+    process.env.GH_AW_RATE_LIMIT_IGNORED_ROLES = "admin,maintain";
+
+    mockGithub.rest.repos = {
+      getCollaboratorPermissionLevel: vi.fn().mockResolvedValue({
+        data: {
+          permission: "maintain",
+        },
+      }),
+    };
+
+    await checkRateLimit.main();
+
+    expect(mockCore.info).toHaveBeenCalledWith(expect.stringContaining("User 'test-user' has ignored role 'maintain'; skipping rate limit check"));
+    expect(mockCore.setOutput).toHaveBeenCalledWith("rate_limit_ok", "true");
+    expect(mockGithub.rest.actions.listWorkflowRuns).not.toHaveBeenCalled();
+  });
+
+  it("should apply rate limiting for users without ignored roles", async () => {
+    process.env.GH_AW_RATE_LIMIT_IGNORED_ROLES = "admin,maintain";
+
+    mockGithub.rest.repos = {
+      getCollaboratorPermissionLevel: vi.fn().mockResolvedValue({
+        data: {
+          permission: "write",
+        },
+      }),
+    };
+
+    mockGithub.rest.actions = {
+      listWorkflowRuns: vi.fn().mockResolvedValue({
+        data: {
+          workflow_runs: [],
+        },
+      }),
+      cancelWorkflowRun: vi.fn(),
+    };
+
+    await checkRateLimit.main();
+
+    expect(mockCore.info).toHaveBeenCalledWith(expect.stringContaining("User 'test-user' has permission level: write"));
+    expect(mockGithub.rest.actions.listWorkflowRuns).toHaveBeenCalled();
+    expect(mockCore.setOutput).toHaveBeenCalledWith("rate_limit_ok", "true");
+  });
+
+  it("should continue with rate limiting if permission check fails", async () => {
+    process.env.GH_AW_RATE_LIMIT_IGNORED_ROLES = "admin";
+
+    mockGithub.rest.repos = {
+      getCollaboratorPermissionLevel: vi.fn().mockRejectedValue(new Error("API error")),
+    };
+
+    mockGithub.rest.actions = {
+      listWorkflowRuns: vi.fn().mockResolvedValue({
+        data: {
+          workflow_runs: [],
+        },
+      }),
+      cancelWorkflowRun: vi.fn(),
+    };
+
+    await checkRateLimit.main();
+
+    expect(mockCore.warning).toHaveBeenCalledWith(expect.stringContaining("Could not check user permissions"));
+    expect(mockCore.warning).toHaveBeenCalledWith(expect.stringContaining("Continuing with rate limit check"));
+    expect(mockGithub.rest.actions.listWorkflowRuns).toHaveBeenCalled();
+    expect(mockCore.setOutput).toHaveBeenCalledWith("rate_limit_ok", "true");
+  });
+
+  it("should handle single ignored role as string", async () => {
+    process.env.GH_AW_RATE_LIMIT_IGNORED_ROLES = "admin";
+
+    mockGithub.rest.repos = {
+      getCollaboratorPermissionLevel: vi.fn().mockResolvedValue({
+        data: {
+          permission: "admin",
+        },
+      }),
+    };
+
+    await checkRateLimit.main();
+
+    expect(mockCore.info).toHaveBeenCalledWith(expect.stringContaining("Ignored roles: admin"));
+    expect(mockCore.info).toHaveBeenCalledWith(expect.stringContaining("User 'test-user' has ignored role 'admin'; skipping rate limit check"));
+    expect(mockCore.setOutput).toHaveBeenCalledWith("rate_limit_ok", "true");
+  });
 });