Unable to create pull request from a workflow with GITHUB_TOKEN

added Architecture Council team:releng labels

added IT-prioritylow IT-severitylow service:GitHub labels

added statewip label and removed statetodo label

@rgrunberg I think that should work with GITHUB_TOKEN. You need to modify permissions for the token, though:

permissions:
  contents: write
  pull-requests: write

as described in https://docs.github.com/en/actions/security-for-github-actions/security-guides/automatic-token-authentication#modifying-the-permissions-for-the-github_token

Default GITHUB_TOKEN permissions are set to Read repository contents and packages permissions. Workflows have read permissions in the repository for the contents and packages scopes only. as oppose to Read and write permissions. Workflows have read and write permissions in the repository for all scopes.

Please let me know if that works for you.

for that to work you have to enable the setting actions_can_approve_pull_request_reviews in your configuration first.

It is disabled on organization level, which prevents it to be enabled on repo level. I will create a PR to update the config.

done https://github.com/eclipse-jdtls/.eclipsefdn/pull/7

should work now imho

Thanks. I'm not able to modify the workflow settings through the GitHub Project UI (restricted at org-level I assume), so if that permissions setting in the workflow file did bypass it, that would be interesting.

I just triggered a build (twice) and it still seems to fail both times :

https://github.com/eclipse-jdtls/eclipse.jdt.ls/actions/runs/13398665807

Pushing pull request branch to 'origin/update_target'
  /usr/bin/git push --force-with-lease origin update_target:refs/heads/update_target
  remote: Permission to eclipse-jdtls/eclipse.jdt.ls.git denied to github-actions[bot].
  fatal: unable to access 'https://github.com/eclipse-jdtls/eclipse.jdt.ls/': The requested URL returned error: 403
  Error: The process '/usr/bin/git' failed with exit code 128

as you cant use the GitHub UI to make changes, you can use the self-service to modify the configuration as needed. The current configuration of your project can be found at:

https://otterdog.eclipse.org/projects/eclipse.jdt.ls

Having said that, your repo https://github.com/eclipse-jdtls/eclipse.jdt.ls has by default read permissions for workflows, so you still have to apply the suggestions from Pawel above to specify that the GITHUB_TOKEN issued during your workflow run can actually create the PR.

Thanks, it worked! I have just one other question.

Why would the eclipse.jdt.ls workflow need permissions : https://github.com/eclipse-jdtls/eclipse.jdt.ls/blob/master/.github/workflows/updateTarget.yml while m2e-core seems to work without it https://github.com/eclipse-m2e/m2e-core/blob/main/.github/workflows/updateTarget.yml . Both repos seem to have default_workflow_permissions: "write" in their configuration.

the eclipse.jdt.ls repo has default workflow permissions set to read:

its overwritten from the organization defaults.

For the m2e-core repo it is left at write.

We advise to use read permissions by default.

That seems fine. Just trying to hash out exactly what the common case will be for most repos as @akurtakov mentioned wanting to add this workflow for some more repos down the road.

well, you can add the permissions in any case.

So when you change the default permissions to read at some point, the workflows will continue to work already.

I think this can be closed. If there're more issues please reopen.

closed

removed statewip label

Unable to create pull request from a workflow with GITHUB_TOKEN

Designs

Child items ...

Activity