fix(prd-1): skip actor check on Forgejo (no bot accounts, avoids read:user scope)

test/actor.test.ts

@@ -1,6 +1,6 @@
 #!/usr/bin/env bun
 
-import { describe, test, expect } from "bun:test";
+import { describe, test, expect, beforeEach, afterEach } from "bun:test";
 import { checkHumanActor } from "../src/github/validation/actor";
 import type { Octokit } from "@octokit/rest";
 import { createMockContext } from "./mockContext";
@@ -94,8 +94,8 @@ describe("checkHumanActor", () => {
     );
   });
 
-  test("should treat undefined actor type as human (Forgejo compatibility)", async () => {
-    // Forgejo's user API doesn't return a `type` field
+  test("should treat undefined actor type as human (GitHub compatibility)", async () => {
+    // Edge case: GitHub API returns no `type` field
     const mockOctokit = {
       users: {
         getByUsername: async () => ({
@@ -104,10 +104,68 @@ describe("checkHumanActor", () => {
       },
     } as unknown as Octokit;
     const context = createMockContext();
-    context.actor = "forgejo-user";
+    context.actor = "unknown-user";
 
     await expect(
       checkHumanActor(mockOctokit, context),
     ).resolves.toBeUndefined();
   });
+
+  describe("Forgejo platform", () => {
+    let savedPlatform: string | undefined;
+    let savedServerUrl: string | undefined;
+
+    beforeEach(() => {
+      savedPlatform = process.env.PLATFORM;
+      savedServerUrl = process.env.GITHUB_SERVER_URL;
+      process.env.PLATFORM = "forgejo";
+    });
+
+    afterEach(() => {
+      if (savedPlatform !== undefined) process.env.PLATFORM = savedPlatform;
+      else delete process.env.PLATFORM;
+      if (savedServerUrl !== undefined)
+        process.env.GITHUB_SERVER_URL = savedServerUrl;
+      else delete process.env.GITHUB_SERVER_URL;
+    });
+
+    test("should skip actor check entirely on Forgejo", async () => {
+      let apiCalled = false;
+      const mockOctokit = {
+        users: {
+          getByUsername: async () => {
+            apiCalled = true;
+            return { data: {} };
+          },
+        },
+      } as unknown as Octokit;
+      const context = createMockContext();
+      context.actor = "forgejo-user";
+
+      await expect(
+        checkHumanActor(mockOctokit, context),
+      ).resolves.toBeUndefined();
+      expect(apiCalled).toBe(false);
+    });
+
+    test("should skip actor check for bot-like names on Forgejo", async () => {
+      let apiCalled = false;
+      const mockOctokit = {
+        users: {
+          getByUsername: async () => {
+            apiCalled = true;
+            return { data: { type: "Bot" } };
+          },
+        },
+      } as unknown as Octokit;
+      const context = createMockContext();
+      context.actor = "some-bot[bot]";
+      context.inputs.allowedBots = "";
+
+      await expect(
+        checkHumanActor(mockOctokit, context),
+      ).resolves.toBeUndefined();
+      expect(apiCalled).toBe(false);
+    });
+  });
 });