GitHub Apps can't receive PR conversation comments via webhook without the Issues permission

[daniel-laszlo]

🏷️ Discussion Type

Bug

💬 Feature/Topic Area

Apps

Body

Hi,

I am building a Slack notification app (https://prflow.dev/) for pull requests. It has pull_requests: read, checks: read and metadata: read permissions and it subscribes to pull_request, pull_request_review, pull_request_review_comment and pull_request_review_thread webhook events.

The issue is that with these permissions, my app doesn't receive webhooks for comments not specific to a codeline in a file - so general PR comments. This would only be delivered via issue_comment event, and it requires Issues: read permission. This design decision doesn't make sense to me seems unnecessarily coupled.

The REST API however seems to handle this case well. GET /repos/{owner}/{repo}/issues/{number}/comments works well with only the pull_requests: read permission.

In case it helps, either of these would solve it: deliver issue_comment events filtered to PRs for apps that only hold pull_requests: read, matching what REST already does, or add a separate event for PR conversation comments under the Pull requests permission.

Thanks.

[github-actions[bot]]

💬 Your Product Feedback Has Been Submitted 🎉

Thank you for taking the time to share your insights with us! Your feedback is invaluable as we build a better GitHub experience for all our users.

Here's what you can expect moving forward ⏩

• Your input will be carefully reviewed and cataloged by members of our product teams. 
  • Due to the high volume of submissions, we may not always be able to provide individual responses.
  • Rest assured, your feedback will help chart our course for product improvements.
• Other users may engage with your post, sharing their own perspectives or experiences. 
• GitHub staff may reach out for further clarification or insight. 
  • We may 'Answer' your discussion if there is a current solution, workaround, or roadmap/changelog post related to the feedback.

Where to look to see what's shipping 👀

• Read the Changelog for real-time updates on the latest GitHub features, enhancements, and calls for feedback.
• Explore our Product Roadmap, which details upcoming major releases and initiatives.

What you can do in the meantime 💻

• Upvote and comment on other user feedback Discussions that resonate with you.
• Add more information at any point! Useful details include: use cases, relevant labels, desired outcomes, and any accompanying screenshots.

As a member of the GitHub community, your participation is essential. While we can't promise that every suggestion will be implemented, we want to emphasize that your feedback is instrumental in guiding our decisions and priorities.

Thank you once again for your contribution to making GitHub even better! We're grateful for your ongoing support and collaboration in shaping the future of our platform. ⭐

[Dasmat13]

You've found a real quirk in GitHub's permission model. Here is the explanation and workaround:

Why this happens

In GitHub's data model, pull request conversation comments and PR review comments are treated differently:

Comment Type	API Endpoint	Permission Required
PR review comments (inline code)	GET /repos/.../pulls/comments	pull_requests: read
PR conversation comments (timeline)	GET /repos/.../issues/comments	issues: read
PR review submissions	GET /repos/.../pulls/.../reviews	pull_requests: read

Pull request conversation (issue-style) comments use the Issues API because GitHub models PRs as a superset of Issues internally. The webhook event for these is issue_comment, not pull_request_review_comment.

The fix

Add issues: read to your GitHub App permissions and subscribe to the issue_comment webhook event:

{
  "default_permissions": {
    "pull_requests": "read",
    "issues": "read"
  }
}

Distinguish PR comments from Issue comments

In the issue_comment webhook payload, check for the presence of issue.pull_request:

{
  "issue": {
    "pull_request": { "url": "..." }  // present = this is a PR comment
  }
}

Webhook event mapping summary

Goal	Subscribe to
Inline PR review comments	pull_request_review_comment
PR conversation thread comments	issue_comment
PR review submit/approve/request-changes	pull_request_review
PR opened/closed/merged	pull_request

This is one of the most common gotchas when building GitHub Apps — hope it unblocks your Slack notification app at prflow.dev!