Resolve actor account type before applying allowed_bots (#1330)

Move the allowed_bots check in checkHumanActor and checkWritePermissions so
it only fires after the actor has been resolved as a non-User account
(GitHub App / bot, or unresolvable app actor). Actors that resolve to a
regular User account go through the standard human/write checks regardless
of allowed_bots.

The Copilot-style path (GITHUB_ACTOR not ending in [bot] and not resolvable
as a user) is unchanged: it still falls through to the existing 404 catch,
which already consults allowed_bots once the API has reported the actor is
not a user.

Update tests to match and add coverage for the User-account path.

test/actor.test.ts

@@ -97,7 +97,8 @@ describe("checkHumanActor", () => {
   describe("non-[bot] actors (e.g. GitHub Copilot)", () => {
     // GitHub Copilot SWE Agent sets GITHUB_ACTOR="Copilot" which is not a
     // valid GitHub user and doesn't end with [bot], causing 404 on the
-    // Users API. These tests verify the fix handles this gracefully.
+    // Users API. allowed_bots is applied once the API has resolved the
+    // actor as not being a regular user account.
 
     function createMockOctokitThat404s(): Octokit {
       return {
@@ -117,7 +118,6 @@ describe("checkHumanActor", () => {
       context.actor = "Copilot";
       context.inputs.allowedBots = "copilot,cursor";
 
-      // Should not even call the API — allowed_bots check happens first
       await expect(
         checkHumanActor(mockOctokit, context),
       ).resolves.toBeUndefined();
@@ -167,4 +167,52 @@ describe("checkHumanActor", () => {
       ).resolves.toBeUndefined();
     });
   });
+
+  describe("account type resolution", () => {
+    // The Users API resolves the actor's account type before allowed_bots
+    // is consulted. allowed_bots is only relevant for Bot accounts and
+    // unresolvable app actors; it does not change behavior for regular
+    // User accounts.
+
+    test("should pass for a User account whose name matches allowed_bots", async () => {
+      const mockOctokit = createMockOctokit("User");
+      const context = createMockContext();
+      context.actor = "renovate";
+      context.inputs.allowedBots = "renovate";
+
+      await expect(
+        checkHumanActor(mockOctokit, context),
+      ).resolves.toBeUndefined();
+    });
+
+    test("should pass for a User account when allowed_bots is '*'", async () => {
+      const mockOctokit = createMockOctokit("User");
+      const context = createMockContext();
+      context.actor = "some-user";
+      context.inputs.allowedBots = "*";
+
+      await expect(
+        checkHumanActor(mockOctokit, context),
+      ).resolves.toBeUndefined();
+    });
+
+    test("should resolve account type even when actor name appears in allowed_bots", async () => {
+      // The Users API call should not be short-circuited by allowed_bots,
+      // so an unexpected API error propagates instead of being swallowed.
+      const mockOctokit = {
+        users: {
+          getByUsername: async () => {
+            throw new Error("Internal Server Error");
+          },
+        },
+      } as unknown as Octokit;
+      const context = createMockContext();
+      context.actor = "some-user";
+      context.inputs.allowedBots = "some-user";
+
+      await expect(checkHumanActor(mockOctokit, context)).rejects.toThrow(
+        "Internal Server Error",
+      );
+    });
+  });
 });