Repository navigation
🐛🧑💻 - Private pull request linkage inspection ignores authentication and fails with HTTP 404 #610
Description
Is there an existing issue for this?
- I have searched the existing issues.
Which actions are affected?
Pull Request
Which platforms are affected?
Linux (observed; the HTTP behavior is platform-independent)
Description
Copilot v3.9.0 cannot inspect issue linkage when opening a pull request in a private consumer repository. PullRequestLifecycleRepository.isLinked accepts _token but performs an unauthenticated fetch against the GitHub HTML pull-request URL. GitHub returns HTTP 404 for a private pull request without an authenticated browser session, even when the configured contributor token can read the same PR through the REST API.
The Action then reports provider.unavailable and fails the pull-request workflow. This is deterministic for a private repository, rather than a temporary provider outage. It can fail the overall workflow even when the separate code review completes.
Expected: inspect linkage through an authenticated, supported API using the supplied credentials; retain exact PR/issue identity and existing lifecycle safeguards. Provide an accurate diagnostic if the operation is unsupported. Do not make the repository public, broaden permissions unnecessarily, or bypass linkage verification.
Reproducing the issue
- Configure
vypdev/copilot@v3for a private consumer repository using a token that can read and update its pull requests and issues. - Start an admitted issue and open its linked managed-branch PR using the normal workflow.
- Observe
LinkPullRequestIssueUseCasefail while inspecting linkage. - Inspect pinned source
src/data/repository/pull_request/pull_request_lifecycle_repository.tsat40dc4ad1d7ff5bebd7efd52f9429391cc9869577:isLinkedignores_tokenand callsfetch(pullRequestUrl, { signal: controller.signal })without authentication. - Compare status-only requests for the affected PR: anonymous HTML returns 404; authenticated REST retrieves the PR successfully. No credentials or response bodies are needed in the report.
Observed in private consumer PRs #190 and #191. Example affected workflow: https://github.com/vypdev/platform/actions/runs/39347109203 (access required).
copilot Version
v3.9.0; floating v3 resolved to 40dc4ad1d7ff5bebd7efd52f9429391cc9869577.
Relevant Log Output
Executing LinkPullRequestIssueUseCase.
Unable to inspect issue linkage for pull request #191.
Error code: provider.unavailable
Independent status-only reproduction: anonymous PR HTML HTTP 404; authenticated REST HTTP 200.
Additional context and comments
This is distinct from #605 / #607: that fix authenticates Git fetch for private issue-branch creation. Branch creation now works; this remaining defect is in PR linkage inspection. No consumer credentials, branch-protection settings, workflow permissions, or lifecycle labels were changed as a workaround.
Suggested regression coverage: authenticated private PR linkage, public PR linkage, genuine 403/404 and transport errors, retained base/description on failure, and no unauthenticated HTML dependency.
Metadata
Metadata
Assignees
Labels
Type
Projects
- Status
Activity
[-]Private pull-request linkage inspection ignores authentication and fails with HTTP 404[/-][+]🐛 - Private pull request linkage inspection ignores authentication and fails with HTTP 404[/+]vypbot commentedon Oct 20, 2026
Hi! I’m @vypbot, the Copilot assistant for this repository.
I can answer questions, explain the codebase, propose implementation and test plans, review issues and pull requests for potential bugs or security problems, and help authorized maintainers apply changes.
Try
/copilot helpto see the available commands, or mention @vypbot with your question.[-]🐛 - Private pull request linkage inspection ignores authentication and fails with HTTP 404[/-][+]🐛🧑💻 - Private pull request linkage inspection ignores authentication and fails with HTTP 404[/+]4 remaining items
vypbot commentedon Oct 20, 2026
Issue closed — historical progress
Current status: closed as completed.
The last estimate is retained below as history. Closure does not certify a new percentage, tests, or branch alignment.
Action required: none for this closed issue. If work continues, reopen the issue; a fresh assessment can update this same card.
Last assessment before closure (historical)
Merge pull request #612 from vypdev/bugfix/610-private-pull-request-l…
vypbot commentedon Oct 20, 2026
Issue closed: synchronization recommendation retired
No branch synchronization is required for this closed issue.
The previous recommendation is historical. Issue closure does not certify that the branches are synchronized.