From d1e72d05852ca117ef38962b5c98212027e1c22a Mon Sep 17 00:00:00 2001
From: Armin Ronacher <armin.ronacher@active-4.com>
Date: Mon, 6 Jul 2026 00:40:28 +0200
Subject: [PATCH] fix(coding-agent): use PAT directly for issue analysis auth

---
 .github/workflows/issue-analysis.yml | 41 ++++++++++++++++++++++------
 1 file changed, 32 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/issue-analysis.yml b/.github/workflows/issue-analysis.yml
index d2200e75d..f68c4878d 100644
--- a/.github/workflows/issue-analysis.yml
+++ b/.github/workflows/issue-analysis.yml
@@ -63,13 +63,33 @@ jobs:
             }
 
             try {
-              const { getOctokit } = require('@actions/github');
-              const orgGithub = getOctokit(process.env.ORG_READ_TOKEN);
-              const { data: membership } = await orgGithub.rest.teams.getMembershipForUserInOrg({
-                org: 'earendil-works',
-                team_slug: 'staff',
-                username,
-              });
+              const response = await fetch(
+                `https://api.github.com/orgs/earendil-works/teams/staff/memberships/${encodeURIComponent(username)}`,
+                {
+                  headers: {
+                    Accept: 'application/vnd.github+json',
+                    Authorization: `Bearer ${process.env.ORG_READ_TOKEN}`,
+                    'X-GitHub-Api-Version': '2022-11-28',
+                  },
+                },
+              );
+
+              if (response.status === 404) {
+                await removeTriggerLabel();
+                core.setFailed(`@${username} is not an active earendil-works/staff member.`);
+                return;
+              }
+
+              if (!response.ok) {
+                const body = await response.text();
+                await removeTriggerLabel();
+                core.setFailed(
+                  `Could not verify earendil-works/staff membership for @${username}: HTTP ${response.status} ${body}`,
+                );
+                return;
+              }
+
+              const membership = await response.json();
               if (membership.state !== 'active') {
                 await removeTriggerLabel();
                 core.setFailed(`@${username} is not an active earendil-works/staff member.`);
@@ -78,8 +98,11 @@ jobs:
               console.log(`earendil-works/staff membership for @${username}: ${membership.state}`);
             } catch (error) {
               await removeTriggerLabel();
-              const status = typeof error === 'object' && error !== null && 'status' in error ? error.status : 'unknown';
-              core.setFailed(`Could not verify earendil-works/staff membership for @${username}: ${status}`);
+              core.setFailed(
+                `Could not verify earendil-works/staff membership for @${username}: ${
+                  error instanceof Error ? error.message : String(error)
+                }`,
+              );
               return;
             }