Comment api does not describe "commit_id has been locked"

General problem: there is little to no documentation about "commit_id has been locked"

There’s only one place Google knows of that talks about this error:

Here’s a sample:

  "message": "Validation Failed",
  "errors": [
      "resource": "CommitComment",
      "code": "custom",
      "field": "commit_id",
      "message": "commit_id has been locked"
  "documentation_url": ""

I have a bot which is able to make a comment using the default GITHUB_TOKEN.

It then receives the URL for that comment and tries to update it.

It seems to work fine for public repositories.

In this instance, it’s running against a private repository. The event is push.

doesn’t seem to have a locked parameter, so it doesn’t look like the bot could create an unlocked comment if it wanted to.

What I’m trying to do is create a comment and then update the comment with the url of the comment.

Here’s an example of how I use it.


  1. Could more documentation be added that talks about locked comments?
  2. Could something please explain what causes this comment to be locked?
  3. Please keep in mind that the explanation of “the bot doesn’t have permission” is a bit disingenuous, because the bot created the comment using the same token a few moments ago.

Yes, I suspect I could create a custom token for the repo and give it to the bot, but having just spent a release moving to pull_request_target to finally get working tokens, the idea that the auto-tokens don’t work is pretty disappointing.

I imagine that the returned comment data from the original post could include a magic token that I could give back to my bot in order to let it edit the comment it just created if people don’t want to generally allow random things to rewrite comments, but still want to be nice to the entities that are creating comments.

1 Like

Fwiw, the cited documentation says:

Default response

Status: 200 OK

Resource not found

Status: 404 Not Found

(that’s it)

It definitely makes no mention of this case. Which makes the error message fairly unhelpful.

Fwiw, I have also observed this error message.

I have a scheduled workflow with concurrency set such that only once instance can ever be running. Despite this, the workflow is unable to update a commit comment which was created by a previous run of the same workflow. It uses the “Update a commit comment” API and reports the same error as noted by @jsoref.

I can’t think of the reasoning for the error message.

I have worked around the problem by making the workflow delete the comment, then create a new comment with the updated body text.

My feeling is that if it is valid to delete a previously created commit comment, it should also be valid to update it?

I’m trying to stash a self-reference into the comment, so deleting & recreating wouldn’t work.

What I could (and might) do is collapse the initial comment and then store a reference to it in the second comment.