From 085e591c3a9c0cf5d40546bc0b74c8df639d3054 Mon Sep 17 00:00:00 2001 From: Lucius Bachmann Date: Wed, 4 Nov 2026 13:03:03 +0000 Subject: [PATCH] fix autorelease for pull requests from forks The Autorelease workflow failed on projectsyn/component-solution-backup#6 (run 41829920010) with: HttpError: Resource not accessible by integration POST /repos/projectsyn/component-solution-backup/issues/6/comments -> 403 Root cause: the job runs on `pull_request`. That PR was opened from the bacluc-agent fork, and GitHub always hands such runs a read-only GITHUB_TOKEN with no secrets ("GITHUB_TOKEN Permissions ... Issues: read" and "Secret source: None" in the run log). The permissions key cannot lift that restriction for fork runs, so every API write done by projectsyn/pr-label-tag-action fails: the PR comment (issues), the release tag (contents) and the "Release" workflow dispatch (actions). PRs on branches inside the repository (for example the Renovate ones, or component-solution-backup#1 which released v0.1.0) are unaffected, which is why the same workflow file works in the other component repositories. Switch the trigger to `pull_request_target`, which runs the base branch's workflow with a write token even for public forks, and declare the three permissions the action needs so the job no longer depends on the repository's default workflow permissions. The job only reads the PR metadata from the event payload and never checks out or executes code from the PR, which is what makes pull_request_target safe here. Consequence: runs for PRs from contributors without write access now need a maintainer to approve them, as they carry a write token. --- .github/workflows/auto-release.yaml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/auto-release.yaml b/.github/workflows/auto-release.yaml index d58df37..17762af 100644 --- a/.github/workflows/auto-release.yaml +++ b/.github/workflows/auto-release.yaml @@ -1,7 +1,7 @@ name: Autorelease -# pull_request_target (and not pull_request) because this job writes through the -# GitHub API, and GITHUB_TOKEN is read-only for pull_request runs from forks. -# This job never checks out or runs code from the PR, only its metadata. +# Not pull_request: that gives fork PRs a read-only GITHUB_TOKEN, and this job +# writes through the API. This job never checks out or runs code from the PR, +# only reads its metadata from the event payload. on: pull_request_target: types: @@ -12,7 +12,7 @@ on: permissions: contents: write - issues: write + pull-requests: write # PR comments are checked against this, not issues actions: write jobs: