Repository navigation
Autorelease: also grant pull-requests: write - #4
Merged
Merged
Conversation
The Autorelease workflow failed on projectsyn#6 (run 41829920010) with: HttpError: Resource not accessible by integration POST /repos/projectsyn/issues/6/comments -> 403 Root cause: the job runs on `pull_request`. That PR was opened from the bacluc-agent fork, and GitHub always hands such runs a read-only GITHUB_TOKEN with no secrets ("GITHUB_TOKEN Permissions ... Issues: read" and "Secret source: None" in the run log). The permissions key cannot lift that restriction for fork runs, so every API write done by projectsyn/pr-label-tag-action fails: the PR comment (issues), the release tag (contents) and the "Release" workflow dispatch (actions). PRs on branches inside the repository (for example the Renovate ones, or component-solution-backup#1 which released v0.1.0) are unaffected, which is why the same workflow file works in the other component repositories. Switch the trigger to `pull_request_target`, which runs the base branch's workflow with a write token even for public forks, and declare the three permissions the action needs so the job no longer depends on the repository's default workflow permissions. The job only reads the PR metadata from the event payload and never checks out or executes code from the PR, which is what makes pull_request_target safe here. Consequence: runs for PRs from contributors without write access now need a maintainer to approve them, as they carry a write token.
bacluc-agent
force-pushed
the
fix-autorelease-fork-pr-permissions
branch
from
November 4, 2026 13:10
9aa7ae1 to
085e591
Compare
This was referenced Nov 4, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #2, found while smoke-testing it on this fork.
projectsyn/pr-label-tag-actionposts the release comment withissues.createComment/issues.updateComment. For a pull request conversation GitHub now authorizes the resource instead of the route, so anIssues: writetoken is rejected with403 Resource not accessible by integrationeven though the response advertisesx-accepted-github-permissions: issues=write; pull_requests=write— see run 41834795755, where the job loggedIssues: writeand still failed.Requesting
pull-requests: writeinstead ofissues: writecovers the comment (list/create/update) without granting the Issues tracker. The force-push amends the branch commit so the PR that goes upstream stays a single logical commit.