fix: permissions and review sync corrections

Signed-off-by: darshit2308 <darshit2308@gmail.com>

Author: darshit2308

.github/scripts/review-sync/helpers/permissions.js

@@ -19,6 +19,8 @@
 
 const { getLatestReviewStates } = require('./reviews');
 
+const permissionCache = new Map();
+
 /**
  * Check the repository role for a given user.
  *
@@ -31,6 +33,10 @@ const { getLatestReviewStates } = require('./reviews');
  * @returns {string} 'admin' | 'maintain' | 'write' | 'triage' | 'read' | 'none'
  */
 async function getPermissionLevel(github, owner, repo, username) {
+  if (permissionCache.has(username)) {
+    return permissionCache.get(username);
+  }
+
   try {
     const { data } = await github.rest.repos.getCollaboratorPermissionLevel({
       owner,
@@ -40,15 +46,19 @@ async function getPermissionLevel(github, owner, repo, username) {
     // CRITICAL: Use role_name, NOT permission.
     // The legacy 'permission' field maps maintain → write, triage → read.
     // role_name correctly returns: admin | maintain | write | triage | read
-    return data.role_name || data.permission || 'none';
+    const role = data.role_name || data.permission || 'none';
+    permissionCache.set(username, role);
+    return role;
   } catch (error) {
     if (error.status === 404) {
       // External contributor — not a collaborator
+      permissionCache.set(username, 'none');
       return 'none';
     }
     // Log unexpected errors but don't crash the run
     const message = error instanceof Error ? error.message : String(error);
     console.log(`    ⚠ Permission check failed for ${username}: ${message}. Treating as "none".`);
+    permissionCache.set(username, 'none');
     return 'none';
   }
 }

.github/scripts/review-sync/index.js

@@ -90,6 +90,6 @@ module.exports = async ({ github, context, core }) => {
   console.log(`  Errors: ${errors}`);
 
   if (errors > 0) {
-    process.exitCode = 1;
+    core.setFailed(`Review sync completed with ${errors} error(s). Check logs above.`);
   }
 };

.github/workflows/review-sync.yml

@@ -23,7 +23,7 @@ on:
         type: string
 
 permissions:
-  pull-requests: read
+  pull-requests: write
   issues: write
   contents: read
 

.github/workflows/test-review-sync.yml

@@ -0,0 +1,35 @@
+name: Test Review Sync Scripts
+
+on:
+  pull_request:
+    paths:
+      - '.github/scripts/review-sync/**'
+      - '.github/workflows/test-review-sync.yml'
+
+jobs:
+  test:
+    runs-on: hl-sdk-py-lin-md
+    steps:
+      - name: Harden the runner
+        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
+        with:
+          egress-policy: audit
+
+      - name: Checkout repository
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          sparse-checkout: |
+            .github/scripts
+          sparse-checkout-cone-mode: false
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+
+      - name: Run Unit Tests
+        run: |
+          node .github/scripts/review-sync/tests/test-labels.js
+          node .github/scripts/review-sync/tests/test-permissions.js
+          node .github/scripts/review-sync/tests/test-reviews.js
+          node .github/scripts/review-sync/tests/test-utils.js