Resource not accessible by integration when using from fork PRs #31

rchiodo · 2020-10-09T00:20:54Z

Getting this error here when this action runs from a PR from a fork:

Posting status 'completed' with conclusion 'failure' to https://github.com/microsoft/vscode-python/pull/14326 (sha: f4e60b0f743a056b5bfdfe4c85388eeff145b22e)
Error: Resource not accessible by integration

I believe that's because of this:
https://docs.github.com/en/free-pro-team@latest/actions/reference/authentication-in-a-workflow#permissions-for-the-github_token

Fork PRs don't get write access.

Is there a way to get the report to work without requiring write access?

The text was updated successfully, but these errors were encountered:

jmisur · 2020-10-15T11:43:44Z

Hi @rchiodo, I don't know, but I know people have problems with forks/PRs and GitHub actions in general. Please let me know when you find out and something needs to be fixed in this repo.

rchiodo · 2020-10-15T16:16:52Z

Thanks. Other junit reporters seem to have the same problem. This may be the way to fix it?
shyim/junit-report-annotations-action#3

slawekjaranowski · 2020-12-02T12:49:58Z

Maybe workflow_run event can help in this case

https://docs.github.com/en/free-pro-team@latest/actions/reference/events-that-trigger-workflows#workflow_run

The https://github.com/ScaCap/action-surefire-report action has a bug that prevents it from running properly on PRs from forks: ScaCap/action-surefire-report#31.

…caCap/action-surefire-report#31

devinrsmith · 2021-05-08T12:25:23Z

This may be solvable using the workflow_run event trigger. There is an example here.

Unfortunately, it requires a bunch of extra action configuration.

action-surefire-report very important for our dev workflow though, so I'm going to be working up a solution soon - I'll make sure to link back to here for context.

devinrsmith · 2021-05-10T18:51:50Z

For reference, deephaven/deephaven-core#547

jamie-wearsafe · 2021-07-13T19:42:33Z

@jmisur can you use pull_request_target instead of pull_request?

jmisur · 2021-07-15T07:26:20Z

@jmisur can you use pull_request_target instead of pull_request?

Definitely not as it's not secure https://securitylab.github.com/research/github-actions-preventing-pwn-requests/

I might however tinker with workflow_run style, but it's super unfortunate that such hacks are necessary.

The https://github.com/ScaCap/action-surefire-report action has a bug that prevents it from running properly on PRs from forks: ScaCap/action-surefire-report#31.

huehnerlady · 2021-11-12T07:39:45Z

Is there any update on this?I mean it has been open a while now...

Since using dependabot more and more we run into this problem more and more :(

huehnerlady · 2021-11-19T11:09:26Z

It seems you can add permissions to the workflow, I got the build to work again once I added the following to the job:

    permissions:
      checks: write
      contents: read
      issues: read
      pull-requests: write

see also here

ScaCap/action-surefire-report#31 (comment)

* Bump plexus-utils from 3.4.2 to 3.5.0 Bumps [plexus-utils](https://github.com/codehaus-plexus/plexus-utils) from 3.4.2 to 3.5.0. - [Release notes](https://github.com/codehaus-plexus/plexus-utils/releases) - [Commits](codehaus-plexus/plexus-utils@plexus-utils-3.4.2...plexus-utils-3.5.0) --- updated-dependencies: - dependency-name: org.codehaus.plexus:plexus-utils dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * added permission to write to PRs * also permit write to statuses * use permissions as found in an issue ScaCap/action-surefire-report#31 (comment) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Ronny Polley <ronnypolley@googlemail.com>

See ScaCap/action-surefire-report#31 Pull requests from forked repositories currently have token permission issues and the Java CI checks fail. This prevents auto-merging. Pull requests from the dropwizard-repo itself have the following permissions: ``` Actions: write Checks: write Contents: write Deployments: write Discussions: write Issues: write Metadata: read Packages: write Pages: write PullRequests: write RepositoryProjects: write SecurityEvents: write Statuses: write ``` while pull requests from forked repos have the following permissions: ``` Actions: read Checks: read Contents: read Deployments: read Discussions: read Issues: read Metadata: read Packages: read Pages: read PullRequests: read RepositoryProjects: read SecurityEvents: read Statuses: read ```

See ScaCap/action-surefire-report#31 Pull requests from forked repositories currently have token permission issues and the Java CI checks fail. This prevents auto-merging. Pull requests from the dropwizard-repo itself have the following permissions: ``` Actions: write Checks: write Contents: write Deployments: write Discussions: write Issues: write Metadata: read Packages: write Pages: write PullRequests: write RepositoryProjects: write SecurityEvents: write Statuses: write ``` while pull requests from forked repos have the following permissions: ``` Actions: read Checks: read Contents: read Deployments: read Discussions: read Issues: read Metadata: read Packages: read Pages: read PullRequests: read RepositoryProjects: read SecurityEvents: read Statuses: read ``` Refs dropwizard#7586 (cherry picked from commit cb47931)

* Fix token permissions for PRs from forks See ScaCap/action-surefire-report#31 Pull requests from forked repositories currently have token permission issues and the Java CI checks fail. This prevents auto-merging. Pull requests from the dropwizard-repo itself have the following permissions: ``` Actions: write Checks: write Contents: write Deployments: write Discussions: write Issues: write Metadata: read Packages: write Pages: write PullRequests: write RepositoryProjects: write SecurityEvents: write Statuses: write ``` while pull requests from forked repos have the following permissions: ``` Actions: read Checks: read Contents: read Deployments: read Discussions: read Issues: read Metadata: read Packages: read Pages: read PullRequests: read RepositoryProjects: read SecurityEvents: read Statuses: read ``` Refs #7586 (cherry picked from commit cb47931) * Allow workflows to write to issues Refs #7586 (cherry picked from commit bd7c22e) --------- Co-authored-by: Jochen Schalanda <jochen@schalanda.name>

mak-42 · 2023-11-06T13:39:55Z

It seems you can add permissions to the workflow, I got the build to work again once I added the following to the job:

I tried to add write permission to the workflow for everything, but it does not help. Could you please prompt me what I am doing wrong?
My workflow: https://github.com/mak-42/action-surefire-report-bug1/blob/master/.github/workflows/maven.yml
It works locally well, but failed when running a pull request from a fork: https://github.com/mak-42/action-surefire-report-bug1/actions/runs/6768710772/job/18399735881?pr=3#logs

See ScaCap/action-surefire-report#31

alvarosanchez mentioned this issue Nov 20, 2020

The Publish Test Report step fails from forked repos micronaut-projects/micronaut-project-template#62

Closed

mzyromski-atlassian mentioned this issue Dec 9, 2020

JPERF-714: Remove Publish Test Report GHA step altogether atlassian/report#54

Merged

squidboylan mentioned this issue Dec 9, 2020

Fix test reporting ansible/receptor#271

Closed

ChrisRBe mentioned this issue Jan 17, 2021

Add real daily aggregation, fix small numbers ChrisRBe/PP-P2P-Parser#269

Merged

normanmaurer mentioned this issue Jan 27, 2021

Use custom script to check for build failures netty/netty#10968

Merged

tivv added a commit to cdapio/cdap that referenced this issue Feb 18, 2021

Remove SureFire report as it does not work with PRs from forks due to S…

5f55ff0

…caCap/action-surefire-report#31

tivv mentioned this issue Feb 18, 2021

Remove SureFire report as it does not work with PRs from forks cdapio/cdap#13132

Merged

devinrsmith mentioned this issue May 10, 2021

Feature request - Ability to skip publishing report #57

Closed

davidjgonzalez mentioned this issue Aug 25, 2021

Feature/run prs with readwrite token Adobe-Consulting-Services/acs-aem-commons#2676

Merged

VincentTNR mentioned this issue Oct 26, 2021

Reverting publish test steps due to issue with PR from fork databrickslabs/transpiler#30

Merged

poikilotherm mentioned this issue Feb 7, 2022

8094 test reports IQSS/dataverse#8404

Closed

naruoga mentioned this issue Mar 15, 2022

ScaCap action couldn't work on Pull-Request event shiftsecurity/jOpenDocument#12

Closed

gesellix mentioned this issue Apr 26, 2022

Update dependencies europace/docker-publish-gradle-plugin#95

Merged

thomedw mentioned this issue Jun 5, 2022

Add permissions block in example #88

Closed

ronnypolley added a commit to ronnypolley/ecliseignorehelper that referenced this issue Nov 6, 2022

use permissions as found in an issue

4369018

ScaCap/action-surefire-report#31 (comment)

LangInteger mentioned this issue May 17, 2023

fix: mget with multiple keys in different slots but first two in the same slot will fail vert-x3/vertx-redis-client#386

Merged

zUniQueX mentioned this issue Sep 26, 2023

Fix token permissions for PRs from forks dropwizard/dropwizard#7586

Merged

zUniQueX mentioned this issue Oct 18, 2023

Fix token permissions 3.0.x dropwizard/dropwizard#7747

Merged

fmasa added a commit to fmasa/firebase-java-sdk that referenced this issue May 7, 2024

Remove test report step

ce94b59

See ScaCap/action-surefire-report#31

ryanemerson mentioned this issue Jul 3, 2024

CI action on pull request open infinispan/infinispan#12554

Merged

HeikoBornholdt added a commit to drasyl/drasyl that referenced this issue Nov 3, 2024

Fix token permissions for PRs

5aa91ee

See ScaCap/action-surefire-report#31

HeikoBornholdt added a commit to drasyl/drasyl that referenced this issue Nov 3, 2024

Fix token permissions for PRs

70c0a78

See ScaCap/action-surefire-report#31

HeikoBornholdt mentioned this issue Nov 3, 2024

Fix token permissions for PRs drasyl/drasyl#833

Merged

HeikoBornholdt added a commit to drasyl/drasyl that referenced this issue Nov 3, 2024

Fix token permissions for PRs (#833)

2b03f3a

See ScaCap/action-surefire-report#31

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Resource not accessible by integration when using from fork PRs #31

Resource not accessible by integration when using from fork PRs #31

rchiodo commented Oct 9, 2020

jmisur commented Oct 15, 2020

rchiodo commented Oct 15, 2020

slawekjaranowski commented Dec 2, 2020

devinrsmith commented May 8, 2021

devinrsmith commented May 10, 2021

jamie-wearsafe commented Jul 13, 2021

jmisur commented Jul 15, 2021

huehnerlady commented Nov 12, 2021 •

edited

Loading

huehnerlady commented Nov 19, 2021

mak-42 commented Nov 6, 2023

Resource not accessible by integration when using from fork PRs #31

Resource not accessible by integration when using from fork PRs #31

Comments

rchiodo commented Oct 9, 2020

jmisur commented Oct 15, 2020

rchiodo commented Oct 15, 2020

slawekjaranowski commented Dec 2, 2020

devinrsmith commented May 8, 2021

devinrsmith commented May 10, 2021

jamie-wearsafe commented Jul 13, 2021

jmisur commented Jul 15, 2021

huehnerlady commented Nov 12, 2021 • edited Loading

huehnerlady commented Nov 19, 2021

mak-42 commented Nov 6, 2023

huehnerlady commented Nov 12, 2021 •

edited

Loading