What's new

Private repo support (GitHub Free)

The action now works on private repos across all GitHub plans. On GitHub Free, gh pr checks fails because its internal GraphQL query accesses a restricted field (checkSuite.workflowRun). When this happens, the action automatically falls back to REST API polling — no configuration required.

New inputs

How the fallback works

1. gh pr checks --watch --required is tried first (better UX with streamed check names)
2. If it fails with Resource not accessible by integration, the action switches to polling /commits/{sha}/check-runs and /commits/{sha}/status REST endpoints
3. The trust-but-verify GraphQL step is unchanged — its query doesn't use the restricted fields

What's Changed

• Fixed permission validation: The contents: write check now uses a direct write test instead of the repo endpoint's .permissions field, which didn't reliably reflect GITHUB_TOKEN permissions when set at the workflow level.
• Updated error messages: Permission error messages now reference both workflow and job level placement.

Full Changelog: v1.1.2...v1.1.3

What's Changed

• Permission validation: The action now validates token permissions (contents:write, pull-requests:write, checks:read, statuses:read) upfront and provides a clear, actionable error message with the exact permissions: block needed if any are missing.

Full Changelog: v1.1.1...v1.1.2

Bug fix

• Fix GraphQL verification for fork PRs — the verification step was querying the head repo (fork) for the PR number, which doesn't exist there. Now correctly queries the base repo where the PR lives.

What's new

• No more job-level if: required — the action now checks for the trigger label and draft status internally. Existing workflows with the if: still work (backwards compatible).
• Graceful skip when no required checks are configured — instead of failing, the action exits with result=skipped.
• Better error messages — clear guidance when contents: write is missing.

Migration

If you're on v1, just update your workflow to remove the job-level conditional — or leave it in place, both work:

jobs:
  mark-ready:
    runs-on: ubuntu-latest
    steps:
      - uses: kenyonj/mark-ready-when-ready@v1
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}