Skip to content

.github/workflows/lint_pr_labels.yml doesn't declare permissions and thus doesn't work in paranoid forks #12407

@jsoref

Description

@jsoref

Describe the bug

When I go to https://github.com/check-spelling-sandbox/decidim/actions/runs/7845617160/job/21410458259 I see an ❌ and

github.GithubException.GithubException: 403 {"message": "Resource not accessible by integration", "documentation_url": "https://docs.github.com/rest/pulls/reviews#create-a-review-for-a-pull-request"}

To Reproduce

  1. Create an org
  2. https://docs.github.com/en/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#configuring-the-default-github_token-permissions -- ensure that you're set to readonly permissions
  3. Fork this repository
  4. Create a PR within your fork

Expected behavior

.github/workflows/lint_pr_labels.yml should run w/o triggering any errors.

Screenshots

No response

Stacktrace

Valid labels are: ['type: feature', 'type: change', 'type: fix', 'type: removal', 'target: developer-experience', 'type: internal']
Invalid labels are: ['type: bug']
PR reviews are: enabled
Pull request number: 1
This pull request does not contain invalid labels
This pull request contains the following valid labels: ['type: fix']
All labels are OK in this pull request
Traceback (most recent call last):
  File "/verify_pr_lables.py", line 264, in <module>
    pr.create_review(event='APPROVE')
  File "/usr/local/lib/python3.6/site-packages/github/PullRequest.py", line 485, in create_review
    "POST", self.url + "/reviews", input=post_parameters
  File "/usr/local/lib/python3.6/site-packages/github/Requester.py", line 31[9](https://github.com/check-spelling-sandbox/decidim/actions/runs/7845617160/job/21410458259#step:3:10), in requestJsonAndCheck
    verb, url, parameters, headers, input, self.__customConnection(url)
  File "/usr/local/lib/python3.6/site-packages/github/Requester.py", line 342, in __check
    raise self.__createException(status, responseHeaders, output)
github.GithubException.GithubException: 403 {"message": "Resource not accessible by integration", "documentation_url": "https://docs.github.com/rest/pulls/reviews#create-a-review-for-a-pull-request"}

Extra data

  • Device OS: Ubuntu 22.04.3 LTS
  • Decidim Version: HEAD

Additional context

Workflows should declare their required permissions in order to play nicely.

I'm happy to make a PR for this (but not this week).

(I have a very large PR pending, but I'm trying to get it green before I post it.)

👋

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions