Add member token

README.md

@@ -42,8 +42,11 @@ jobs:
 | Name              | Description                                                |
 | ----------------- | ---------------------------------------------------------- |
 | `repo-token`      | GitHub access token                                        |
+| `member-token`    | Token with read access to organization members             |
 | `duplicate-label` | Label to add on duplicate command and auto duplicate check |
 
+If `member-token` is not provided, `repo-token` will be used to check user's membership. In this case, the action might fail to verify private members.
+
 ### Auto closers
 
 | Name                      | Description                                                                                     |

action.yml

@@ -11,6 +11,9 @@ inputs:
   repo-token:
     required: true
     description: GitHub token
+  member-token:
+    required: false
+    description: Token with read access to organization members
   duplicate-label:
     required: false
     description: Label to add on duplicate command and auto duplicate check

src/feature/commands/index.ts

@@ -74,18 +74,16 @@ export async function checkForCommand() {
     core.getInput('repo-token', { required: true }),
   );
 
-  // Get all the members from the organization.
-  const allowedMembers = await client.rest.orgs.listMembers({
-    org: repo.owner,
-  });
-  if (allowedMembers.status !== 200) {
-    core.info('Failed to fetch the members from the organization');
-    return;
-  }
-  if (
-    !allowedMembers.data.find((member) => member.login === commentUser.login)
-  ) {
-    core.info('The comment author is not a organization member');
+  try {
+    const memberToken = core.getInput('member-token');
+    const memberClient = memberToken ? github.getOctokit(memberToken) : client;
+
+    await memberClient.rest.orgs.checkMembershipForUser({
+      org: repo.owner,
+      username: commentUser.login,
+    });
+  } catch (_) {
+    core.info('Could not verify the membership of the comment author');
     return;
   }