fix: survive a 403 whose body is not a JSON object

GithubException.data is whatever the response decoded to: None for an
empty body, a str for a non-JSON one. Calling .get on it raises inside
the 403 handler, and an exception raised there is not caught by the
sibling except clauses — it escapes add_pr_comments and fails the step.
That is the opposite of what this handler exists to do.

Verified both shapes raise before the guard and warn after it. The test
stub now stores data exactly as PyGithub does; coercing a falsy payload
to {} was hiding the shapes the handler has to survive.

The 403 test also asserts the API's own message reaches the warning, so
dropping the detail cannot pass unnoticed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01U9zFxq8V4qxG4aMzJhGBFn

Author: shenxianpeng

main.py

@@ -882,10 +882,15 @@ def add_pr_comments(results: list[ScopeResult]) -> int:
         return 0 if all(scope.status == "pass" for scope in results) else 1
     except GithubException as e:
         if e.status == 403:
+            # GithubException.data is whatever the response decoded to, which
+            # is None for an empty body and a str for a non-JSON one. Reaching
+            # for .get unguarded would raise inside this handler and escape the
+            # function, turning the best-effort path into a step failure.
+            detail = e.data.get("message") if isinstance(e.data, dict) else None
             print(
                 "::warning::Unable to post PR comment (403 Forbidden). "
                 "Ensure your workflow grants 'pull-requests: write' permission. "
-                f"Error: {e.data.get('message', str(e))}",
+                f"Error: {detail or e}",
                 file=sys.stderr,
             )
             return 0

main_test.py

@@ -1095,7 +1095,9 @@ class _StubGithubException(Exception):
     def __init__(self, status, data=None):
         super().__init__(f"status {status}")
         self.status = status
-        self.data = data or {}
+        # Stored as given, exactly as PyGithub does. Coercing a falsy payload
+        # to {} here would hide the very shapes the handler has to survive.
+        self.data = data
 
 
 class TestAddPrCommentsFailures(unittest.TestCase):
@@ -1149,6 +1151,21 @@ def test_forbidden_names_the_permission_that_actually_grants_this(self):
         # pull-requests scope, and this hint is the only guidance a user gets.
         self.assertIn("pull-requests: write", warning)
         self.assertNotIn("issues: write", warning)
+        # The API's own wording is what tells the user which resource was
+        # refused, so the hint has to carry it through.
+        self.assertIn("Resource not accessible", warning)
+
+    def test_forbidden_with_a_non_mapping_payload_still_warns(self):
+        # data is whatever the body decoded to: None when empty, a str when it
+        # is not JSON. Reaching for .get on either raises inside the handler
+        # and escapes the function, which would fail the step.
+        for payload in (None, "forbidden"):
+            with self.subTest(payload=payload):
+                rc, printed = self._run(_StubGithubException(403, payload))
+                self.assertEqual(rc, 0)
+                warning = next(w for w in printed if "::warning::" in w)
+                self.assertIn("pull-requests: write", warning)
+                self.assertIn("status 403", warning)
 
     def test_other_api_errors_are_annotated(self):
         rc, printed = self._run(_StubGithubException(500, {"message": "boom"}))