Merge pull request #2040 from cuthbertLab/fix-profiler-issues-permission

Grant profile_contributors the issues:read scope gh-profiler needs

Author: mscuthbert

.github/workflows/profile_contributors.yml

@@ -1,5 +1,5 @@
 # Profile the author of a PR from someone with no merged PR here yet, and comment
-# only when gh-profiler raises a yellow or red flag.
+# only when gh-profiler raises a yellow or red flag, or when it could not run.
 #
 # gh-profiler is by Eric Matthes: https://github.com/ehmatthes/gh-profiler
 
@@ -11,6 +11,9 @@ on:
         types: [opened]
 
 permissions:
+    # gh-profiler reads the author's recent issues; without issues:read the Actions
+    # token cannot resolve Issue objects and every search node comes back empty.
+    issues: read
     pull-requests: write
 
 jobs:
@@ -41,9 +44,18 @@ jobs:
               GH_TOKEN: ${{ github.token }}
               AUTHOR: ${{ github.event.pull_request.user.login }}
           run: |
-              uvx gh-profiler==0.9.0 "$AUTHOR" --concise | tee profile.txt
+              # gh-profiler raises on an issue or PR the token cannot resolve
+              # (ehmatthes/gh-profiler#143), and an unprofiled author is not a red check.
+              if ! uvx gh-profiler==0.9.0 "$AUTHOR" --concise > profile.txt; then
+                  cat profile.txt
+                  echo "::warning::gh-profiler failed on $AUTHOR; profile by hand."
+                  echo "concern=false" >> "$GITHUB_OUTPUT"
+                  echo "failed=true" >> "$GITHUB_OUTPUT"
+                  exit 0
+              fi
+              cat profile.txt
               echo '===================== Full profile ====================='
-              uvx gh-profiler==0.9.0 "$AUTHOR"
+              uvx gh-profiler==0.9.0 "$AUTHOR" || true
 
               # A yellow on the profile section alone means only that the account is
               # newish or has empty bio fields, which is not worth a public comment.
@@ -72,3 +84,18 @@ jobs:
               } > comment.txt
 
               gh pr comment "$PR" --body-file comment.txt
+
+        # The traceback stays in the log; a public comment does not need it.
+        - name: Comment on PR when profiling could not run
+          if: steps.previous.outputs.count == '0' && steps.profile.outputs.failed == 'true'
+          env:
+              GH_TOKEN: ${{ github.token }}
+              PR: ${{ github.event.pull_request.number }}
+          run: |
+              {
+                  echo 'Contributor profiling ([gh-profiler](https://github.com/ehmatthes/gh-profiler))'
+                  echo 'could not run here, so a maintainer will read this PR without it.'
+                  echo 'Nothing is wrong with the pull request itself.'
+              } > comment.txt
+
+              gh pr comment "$PR" --body-file comment.txt