What

When the deterministic executor-e2e suite fails, it files a GitHub issue. Until now, an auth/permission problem surfaced only as an opaque HTTP 401 / HTTP 403 in the ADO log — giving no way to tell whether the token was revoked, under-permissioned, or aimed at the wrong repo. This turned every occurrence into a guessing game.

Change

fileFailureIssue now:

• logs the resolved target repo up front (it can come from a definition variable or the YAML default, and a wrong target is a common cause);
• on any 401/403, probes GET /user and emits an actionable diagnosis:
  • 401 → token invalid/expired/revoked (GitHub auto-revokes plaintext-shared tokens) → generate a fresh one;
  • 403 with a successful /user → authenticated as <login> but lacks Issues:write on the target repo (or, for a fine-grained PAT, a resource-owner / repository-access mismatch), including the x-accepted-github-permissions header.

The diagnosis is best-effort and never throws; the original error is still rethrown so the WARNING keeps the raw status. Issue filing remains non-fatal.

Tests

Adds unit coverage for both the 401-revoked and 403-missing-permission paths. Full src/executor-e2e suite: 22 passing; tsc --noEmit clean; bundle builds.