From 188b1b25083359704533a8efa44b25a6caeb33f4 Mon Sep 17 00:00:00 2001
From: manisbindra <maninder.bindra@gmail.com>
Date: Fri, 17 Apr 2026 17:29:47 +0530
Subject: [PATCH 1/2] fix: allow nightly scan when PR creation is blocked

Handle GitHub Actions PR creation/edit permission failures by
surfacing a manual PR link in the workflow summary instead of
failing after the results branch is pushed.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .github/workflows/nightly-scan.yml | 48 +++++++++++++++++++++++++++---
 1 file changed, 44 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/nightly-scan.yml b/.github/workflows/nightly-scan.yml
index 06ddabd..a6a42c4 100644
--- a/.github/workflows/nightly-scan.yml
+++ b/.github/workflows/nightly-scan.yml
@@ -131,6 +131,22 @@ jobs:
             return 1
           }
 
+          emit_manual_pr_summary() {
+            local message="$1"
+            local manual_pr_url="https://github.com/${GITHUB_REPOSITORY}/pull/new/${BRANCH}"
+
+            echo "::warning::${message}"
+            echo "::warning::Open a PR manually: ${manual_pr_url}"
+            {
+              echo "## Nightly scan results pushed"
+              echo ""
+              echo "${message}"
+              echo ""
+              echo "- Branch: \`${BRANCH}\`"
+              echo "- Open PR manually: ${manual_pr_url}"
+            } >> "$GITHUB_STEP_SUMMARY"
+          }
+
           # Validate expected scan artifacts exist
           MISSING=()
           for f in "${NIGHTLY_ALLOWED_FILES[@]}"; do
@@ -201,15 +217,39 @@ jobs:
           # Create PR if one doesn't already exist (scoped to this repo, not forks)
           EXISTING_PR=$(gh pr list --head "${{ github.repository_owner }}:$BRANCH" --base "$DEFAULT_BRANCH" --state open --json number --jq '.[0].number // empty')
           if [ -z "$EXISTING_PR" ]; then
-            gh pr create \
+            set +e
+            PR_OUTPUT=$(gh pr create \
               --base "$DEFAULT_BRANCH" \
               --head "$BRANCH" \
               --title "$PR_TITLE" \
-              --body-file /tmp/nightly-pr-body.md
+              --body-file /tmp/nightly-pr-body.md 2>&1)
+            PR_STATUS=$?
+            set -e
+
+            if [ $PR_STATUS -eq 0 ]; then
+              printf '%s\n' "$PR_OUTPUT"
+            elif printf '%s' "$PR_OUTPUT" | grep -F -q 'GitHub Actions is not permitted to create or approve pull requests'; then
+              emit_manual_pr_summary "GitHub Actions could not create a pull request with GITHUB_TOKEN."
+            else
+              printf '%s\n' "$PR_OUTPUT" >&2
+              exit $PR_STATUS
+            fi
           else
-            gh pr edit "$EXISTING_PR" \
+            set +e
+            PR_OUTPUT=$(gh pr edit "$EXISTING_PR" \
               --title "$PR_TITLE" \
-              --body-file /tmp/nightly-pr-body.md
+              --body-file /tmp/nightly-pr-body.md 2>&1)
+            PR_STATUS=$?
+            set -e
+
+            if [ $PR_STATUS -eq 0 ]; then
+              printf '%s\n' "$PR_OUTPUT"
+            elif printf '%s' "$PR_OUTPUT" | grep -F -q 'GitHub Actions is not permitted to create or approve pull requests'; then
+              emit_manual_pr_summary "GitHub Actions could not update PR #${EXISTING_PR} with GITHUB_TOKEN."
+            else
+              printf '%s\n' "$PR_OUTPUT" >&2
+              exit $PR_STATUS
+            fi
           fi
 
       - name: 📤 Upload database artifact

From ae2e1b77b24d37ecadf57e2f4a206607c5cd0d26 Mon Sep 17 00:00:00 2001
From: manisbindra <maninder.bindra@gmail.com>
Date: Fri, 17 Apr 2026 17:56:47 +0530
Subject: [PATCH 2/2] fix: clarify manual PR summary link

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .github/workflows/nightly-scan.yml | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/nightly-scan.yml b/.github/workflows/nightly-scan.yml
index a6a42c4..ac86042 100644
--- a/.github/workflows/nightly-scan.yml
+++ b/.github/workflows/nightly-scan.yml
@@ -133,17 +133,18 @@ jobs:
 
           emit_manual_pr_summary() {
             local message="$1"
-            local manual_pr_url="https://github.com/${GITHUB_REPOSITORY}/pull/new/${BRANCH}"
+            local action_url="${2:-https://github.com/${GITHUB_REPOSITORY}/pull/new/${BRANCH}}"
+            local action_label="${3:-Open PR manually}"
 
             echo "::warning::${message}"
-            echo "::warning::Open a PR manually: ${manual_pr_url}"
+            echo "::warning::${action_label}: ${action_url}"
             {
               echo "## Nightly scan results pushed"
               echo ""
               echo "${message}"
               echo ""
               echo "- Branch: \`${BRANCH}\`"
-              echo "- Open PR manually: ${manual_pr_url}"
+              echo "- ${action_label}: ${action_url}"
             } >> "$GITHUB_STEP_SUMMARY"
           }
 
@@ -245,7 +246,10 @@ jobs:
             if [ $PR_STATUS -eq 0 ]; then
               printf '%s\n' "$PR_OUTPUT"
             elif printf '%s' "$PR_OUTPUT" | grep -F -q 'GitHub Actions is not permitted to create or approve pull requests'; then
-              emit_manual_pr_summary "GitHub Actions could not update PR #${EXISTING_PR} with GITHUB_TOKEN."
+              emit_manual_pr_summary \
+                "GitHub Actions could not update PR #${EXISTING_PR} with GITHUB_TOKEN." \
+                "https://github.com/${GITHUB_REPOSITORY}/pull/${EXISTING_PR}" \
+                "Review existing PR manually"
             else
               printf '%s\n' "$PR_OUTPUT" >&2
               exit $PR_STATUS