How to Comment on a Pull Request From a Workflow in GitHub Actions

By Daniel Zoghalchali·Latchkey

actions/github-script calls the REST API with the built-in token to leave a PR comment.

Use actions/github-script to call issues.createComment with the PR number and your message. Grant pull-requests: write permission.

Steps

• Add permissions: pull-requests: write to the job.
• Use actions/github-script with github.rest.issues.createComment.
• Pass context.issue.number as the PR number.

Workflow

permissions:
  pull-requests: write
jobs:
  comment:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/github-script@v7
        with:
          script: |
            await github.rest.issues.createComment({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.issue.number,
              body: 'Build passed and coverage is 92%.'
            })

Gotchas

• On pull_request from a fork, GITHUB_TOKEN is read-only; use pull_request_target carefully.
• Find and update an existing comment to avoid spamming a new one each run.

Verify it actually works

A workflow that runs is not a workflow that works. Confirm the behaviour on a real event rather than on a manual dispatch, because trigger conditions, permissions, and context values all differ between the two.

# 1. validate the file before pushing
docker run --rm -v "$(pwd):/repo" --workdir /repo rhysd/actionlint:latest -color

# 2. trigger the real event, not workflow_dispatch
git commit --allow-empty -m "ci: verify trigger" && git push

# 3. watch it and read the conclusion, not just the colour
gh run watch
gh run view --log-failed

What usually goes wrong first

• The workflow file must exist on the default branch before scheduled or dispatch triggers appear at all.
• GITHUB_TOKEN permissions default to read-only in many organisations. Declare a permissions: block listing every scope the job needs.
• Fork pull requests get a read-only token and no access to secrets, regardless of workflow configuration.
• actions/checkout gives you depth 1 on a detached HEAD, so anything needing history or a branch name needs fetch-depth: 0.

Frequently asked questions

Related guides

References

• GitHub Actions documentation