don't throw on permission errors

Signed-off-by: Andrew Johnson <ajohnson@gocardless.com>

plugins/scaffolder-backend/package.json

@@ -55,6 +55,7 @@
     "handlebars": "^4.7.6",
     "helmet": "^4.0.0",
     "isomorphic-git": "^1.8.0",
+    "jest-when": "^3.1.0",
     "jsonschema": "^1.2.6",
     "knex": "^0.95.1",
     "luxon": "^1.26.0",

plugins/scaffolder-backend/src/scaffolder/actions/builtin/publish/github.test.ts

@@ -22,6 +22,7 @@ import { ConfigReader } from '@backstage/config';
 import { getVoidLogger } from '@backstage/backend-common';
 import { PassThrough } from 'stream';
 import { initRepoAndPush } from '../../../stages/publish/helpers';
+import { when } from 'jest-when';
 
 describe('publish:github', () => {
   const integrations = ScmIntegrations.fromConfig(
@@ -288,6 +289,58 @@ describe('publish:github', () => {
     ]);
   });
 
+  it('should ignore failures when adding multiple collaborators', async () => {
+    mockGithubClient.users.getByUsername.mockResolvedValue({
+      data: { type: 'User' },
+    });
+
+    mockGithubClient.repos.createForAuthenticatedUser.mockResolvedValue({
+      data: {
+        clone_url: 'https://github.com/clone/url.git',
+        html_url: 'https://github.com/html/url',
+      },
+    });
+
+    when(mockGithubClient.teams.addOrUpdateRepoPermissionsInOrg)
+      .calledWith({
+        org: 'owner',
+        owner: 'owner',
+        repo: 'repo',
+        team_slug: 'robot-1',
+        permission: 'pull',
+      })
+      .mockRejectedValueOnce(new Error('Something bad happened') as never);
+
+    await action.handler({
+      ...mockContext,
+      input: {
+        ...mockContext.input,
+        collaborators: [
+          {
+            access: 'pull',
+            username: 'robot-1',
+          },
+          {
+            access: 'push',
+            username: 'robot-2',
+          },
+        ],
+      },
+    });
+
+    expect(
+      mockGithubClient.teams.addOrUpdateRepoPermissionsInOrg.mock.calls[2],
+    ).toEqual([
+      {
+        org: 'owner',
+        owner: 'owner',
+        repo: 'repo',
+        team_slug: 'robot-2',
+        permission: 'push',
+      },
+    ]);
+  });
+
   it('should call output with the remoteUrl and the repoContentsUrl', async () => {
     mockGithubClient.users.getByUsername.mockResolvedValue({
       data: { type: 'User' },

plugins/scaffolder-backend/src/scaffolder/actions/builtin/publish/github.ts

@@ -195,13 +195,19 @@ export function createPublishGithubAction(options: {
           access: permission,
           username: team_slug,
         } of collaborators) {
-          await client.teams.addOrUpdateRepoPermissionsInOrg({
-            org: owner,
-            team_slug,
-            owner,
-            repo,
-            permission,
-          });
+          try {
+            await client.teams.addOrUpdateRepoPermissionsInOrg({
+              org: owner,
+              team_slug,
+              owner,
+              repo,
+              permission,
+            });
+          } catch (e) {
+            ctx.logger.warn(
+              `Skipping ${permission} access for ${team_slug}, ${e.message}`,
+            );
+          }
         }
       }