minor: To be safe. In general, we should try to keep this kind of "safety checks". They might have resulted from past bugs and/or a general approach for this module of playing it safe/pessimistic since we're interacting with a remote system that might not always match our state (I see the old function didn't have this check, but let's add it in any case).
What we should do to improve the fuzzy points, is "enhance" the 400s we throw around with proper error messages, so that we can better understand why things fail when users contact us.
_Originally posted by @slint in https://github.com/inveniosoftware/invenio-github/pull/109#discussion_r1257892282_