Depending on if the action is used on issues or pull requests the GITHUB_TOKEN or PAT needs issues: write or pull_requests: write permissions in order to add reactions. If the token doesn't have sufficient permission the code tries to add the reaction, and continues on even if it failed. This should at least check for the bad response and report an error but ideally it'd throw and not continue on.