fix: retry and log updateBranch failures for update-pull-request

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/64e4d53e-e239-416e-9bf1-20a33e83b86b

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Author: Copilot

actions/setup/js/update_pull_request.cjs

@@ -15,6 +15,8 @@ const { sanitizeTitle } = require("./sanitize_title.cjs");
 const { parseBoolTemplatable } = require("./templatable.cjs");
 const { buildWorkflowRunUrl } = require("./workflow_metadata_helpers.cjs");
 const { generateHistoryUrl } = require("./generate_history_link.cjs");
+const { getErrorMessage } = require("./error_helpers.cjs");
+const { withRetry, isTransientError } = require("./error_recovery.cjs");
 
 /**
  * Execute the pull request update API call
@@ -37,11 +39,26 @@ async function executePRUpdate(github, context, prNumber, updateData) {
 
   if (mergeBase) {
     core.info(`Updating pull request #${prNumber} branch with base branch changes`);
-    await github.rest.pulls.updateBranch({
-      owner: context.repo.owner,
-      repo: context.repo.repo,
-      pull_number: prNumber,
-    });
+    try {
+      await withRetry(
+        () =>
+          github.rest.pulls.updateBranch({
+            owner: context.repo.owner,
+            repo: context.repo.repo,
+            pull_number: prNumber,
+          }),
+        {
+          maxRetries: 1,
+          initialDelayMs: 0,
+          jitterMs: 0,
+          shouldRetry: isTransientError,
+        },
+        `update pull request #${prNumber} branch from base`
+      );
+    } catch (error) {
+      core.warning(`Failed to update pull request #${prNumber} branch from base: ${getErrorMessage(error)}`);
+      throw error;
+    }
   }
 
   // If we have a body, process it with the appropriate operation

actions/setup/js/update_pull_request.test.cjs

@@ -823,4 +823,28 @@ describe("update_pull_request.cjs - merge_base behavior", () => {
       title: "Updated PR",
     });
   });
+
+  it("should retry updateBranch on transient failures", async () => {
+    mockGithub.rest.pulls.updateBranch.mockRejectedValueOnce(new Error("timeout contacting github")).mockResolvedValueOnce({
+      data: { message: "Branch updated after retry" },
+    });
+
+    const handler = await updatePRModule.main({ merge_base: true });
+    const result = await handler({ pull_request_number: 100 });
+
+    expect(result.success).toBe(true);
+    expect(mockGithub.rest.pulls.updateBranch).toHaveBeenCalledTimes(2);
+  });
+
+  it("should log merge-base operation failure when updateBranch fails", async () => {
+    mockGithub.rest.pulls.updateBranch.mockRejectedValueOnce(new Error("branch update forbidden"));
+
+    const handler = await updatePRModule.main({ merge_base: true });
+    const result = await handler({ pull_request_number: 100 });
+
+    expect(result.success).toBe(false);
+    expect(result.error).toContain("update pull request #100 branch from base failed");
+    expect(mockGithub.rest.pulls.updateBranch).toHaveBeenCalledTimes(1);
+    expect(mockCore.warning).toHaveBeenCalledWith(expect.stringContaining("Failed to update pull request #100 branch from base"));
+  });
 });

pkg/workflow/safe_outputs_permissions.go

@@ -147,7 +147,7 @@ func ComputePermissionsForSafeOutputs(safeOutputs *SafeOutputsConfig) *Permissio
 	}
 	if safeOutputs.UpdatePullRequests != nil && !isHandlerStaged(safeOutputs.Staged, safeOutputs.UpdatePullRequests.Staged) {
 		safeOutputsPermissionsLog.Print("Adding permissions for update-pull-request")
-		permissions.Merge(NewPermissionsContentsReadPRWrite())
+		permissions.Merge(NewPermissionsContentsWritePRWrite())
 	}
 	if safeOutputs.ClosePullRequests != nil && !isHandlerStaged(safeOutputs.Staged, safeOutputs.ClosePullRequests.Staged) {
 		safeOutputsPermissionsLog.Print("Adding permissions for close-pull-request")

pkg/workflow/safe_outputs_permissions_test.go

@@ -218,6 +218,20 @@ func TestComputePermissionsForSafeOutputs(t *testing.T) {
 				PermissionPullRequests: PermissionWrite,
 			},
 		},
+		{
+			name: "update-pull-request requires contents write for updateBranch API",
+			safeOutputs: &SafeOutputsConfig{
+				UpdatePullRequests: &UpdatePullRequestsConfig{
+					UpdateEntityConfig: UpdateEntityConfig{
+						BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("1")},
+					},
+				},
+			},
+			expected: map[PermissionScope]PermissionLevel{
+				PermissionContents:     PermissionWrite,
+				PermissionPullRequests: PermissionWrite,
+			},
+		},
 		{
 			name: "create-pull-request with fallback-as-issue (default) - includes issues permission",
 			safeOutputs: &SafeOutputsConfig{