fix: handle GitHub 403 'Resource not accessible' in PR delivery recovery #SUPERLOG

[superlog-app]

Summary

When the Superlog GitHub App installation lacks pull_requests: read permission on a repository, the PR delivery recovery lookup throws a GithubRequestError with status 403 "Resource not accessible by integration". This error was not handled inside listPullRequests in githubPullRequestDeliveryLookup, causing it to propagate through recoverPullRequestDelivery → findGithubPullRequestDelivery → preflightProposedPullRequest, which caught it, logged ERROR, and returned ok: false — blocking PR delivery entirely.

This surfaced in production for taventech/hedge (3 ERROR events between 15:01–15:07 UTC on 2026-08-17, incident eb6caa41-4405-492a-b43a-6ff0a7451649).

Root cause

getBranchHead in the same githubPullRequestDeliveryLookup object already catches 404 via isGithubNotFound and returns null. listPullRequests had no equivalent for the 403 "Resource not accessible" class of error. The distinction matters: a rate-limit 403 is retryable and should propagate; a permission-denied 403 is permanent and should be treated as "no PRs accessible" to allow fresh delivery to proceed.

Remediation

Adds isGithubResourceNotAccessible(err) — parallel to isGithubNotFound — which matches only non-retryable 403 errors whose message contains "Resource not accessible by integration". listPullRequests now catches this condition and returns [], so recoverPullRequestDelivery falls through to null (no prior delivery found) and preflightProposedPullRequest proceeds to fresh delivery rather than failing.

The function is exported so it can be unit-tested directly; one new test covers true-positive, false-positive (rate-limit), false-positive (404), and false-positive (plain Error) cases.

---

Incident: eb6caa41-4405-492a-b43a-6ff0a7451649

---

Was this PR helpful? Leave feedback — goes straight to the Superlog team.

---

Summary by cubic

Handles GitHub 403 “Resource not accessible by integration” during PR delivery recovery so lack of pull_requests: read permission no longer blocks delivery. Previously we threw and failed preflight; now we treat this as “no PRs found” and proceed with fresh delivery. Rate-limit 403s still retry.

• Introduces isGithubResourceNotAccessible to detect non-retryable 403 permission errors.
• Catches the error in githubPullRequestDeliveryLookup.listPullRequests and returns []; other errors still propagate.
• Exports the detector and adds unit tests for permission-denied, rate-limit, 404, and non-GitHub errors.

^{Written for commit 4d1d733. Summary will update on new commits.}