Your workflow token or GitHub App probably does not have enough permissions to create or update PR comments.
Check:
permissions:
contents: read
pull-requests: write
issues: writeIf you use the GitHub App, confirm the installation has:
- Contents: read
- Pull requests: read & write
- Issues: read & write
For pull requests from forks, GitHub may still provide a read-only workflow token. In that case ContextLevy logs a warning, keeps the action successful, still exposes analysis outputs, and writes a job summary — but may not post a PR comment.
Install the GitHub App when your organization policy allows it for more reliable fork PR comments.
See SECURITY.md — Fork pull requests for permission details. See also ACTION.md — Fork pull requests.
Make sure the secret contains the GitHub App private key PEM.
It should look like this:
-----BEGIN RSA PRIVATE KEY-----
...
-----END RSA PRIVATE KEY-----Do not use the app Client Secret.
ContextLevy skips comments below token-threshold. Fail mode (fail-on-severity, fail-above-tokens) still runs in that case — a skipped comment does not mean the check was skipped.
Lower the threshold while testing:
token-threshold: 0That usually means the PR added large generated files, coverage output, build artifacts, or lockfile churn.
If the files are intentional, either ignore the warning or raise your thresholds. See CONFIG.md for threshold and ignore-path options.