Error: Resource not accessible by integration

[vorburger]

In https://github.com/www-learn-study/saraswati.learn.study/actions/runs/6727753248/job/18286039868 I have run into this:

Run marocchino/sticky-pull-request-comment@v2
  with:
    header: pr-preview
    message: [PR Preview Action](https://github.com/rossjrw/pr-preview-action) v1.4.4
  :---:
  :rocket: Deployed preview to https://www-learn-study.github.io/previews/pr-preview/pr-43/
  on branch [`gh-pages`](https://github.com/www-learn-study/saraswati.learn.study/tree/gh-pages) at 2023-11-02 03:00 UTC 
    append: false
    recreate: false
    delete: false
    only_create: false
    only_update: false
    hide_details: false
    hide: false
    hide_and_recreate: false
    hide_classify: OUTDATED
    ignore_empty: false
    skip_unchanged: false
    follow_symbolic_links: false
    GITHUB_TOKEN: ***
  env:
    action: deploy
    targetdir: pr-preview/pr-43
    pr: 43
    pagesurl: www-learn-study.github.io/previews
    emptydir: /tmp/tmp.NX01XUKSxB
    datetime: [202](https://github.com/www-learn-study/saraswati.learn.study/actions/runs/6727753248/job/18286039868#step:4:208)3-11-02 03:00 UTC
    actionref: v1
    actionrepo: rossjrw/pr-preview-action
    deployrepo: www-learn-study/previews
    token: PREVIEW_TOKEN
    action_version: v1.4.4
    deployment_status: success
Error: Resource not accessible by integration

I've figured out how to fix it (permissions: ...), and will post a PR with a proposed docs clarification.

[vorburger]

I thought I fixed this, but am seeing this again, see www-learn-study/saraswati.learn.study#50 (comment).

[rossjrw]

(moved this from an Issue to a Discussion, as it's a request for help and not a bug report/feature request)

@vorburger This looks like a duplicate of #59. The problem there was an issue with the GITHUB_TOKEN. The permissions associated with that token are a bit tight, especially when deploying between repositories. As you're deploying to a dedicated previews repository, though, the security implications are reduced.

You linked a workflow run - looking at the corresponding workflow file (https://github.com/www-learn-study/saraswati.learn.study/actions/runs/6727753248/workflow) I see that a) you are deploying the preview to a different repository from the one that the workflow is running in, b) the token parameter is set to the string "PREVIEW_TOKEN". Assuming that's the name of a personal access token that you've stored in the secrets for the repo, it should presumably be ${{ secrets.PREVIEW_TOKEN }} to get its value.

[vorburger]

Yup, that was a problem, and I've already fixed that with www-learn-study/saraswati.learn.study#44.

Also sent you #64 with a proposed minor doc update contrib about this, which perhaps helps others in the future.

This problem still happens sometimes though. It seems to depend on files touched in the PR. See (the end of) www-learn-study/saraswati.learn.study#50 for details.

It must be a GitHub security thing.

[rossjrw]

From www-learn-study/saraswati.learn.study#50:

What's the difference between www-learn-study/saraswati.learn.study#20 and www-learn-study/saraswati.learn.study#56 that's causing this?! It's probably some security related thing? The change in an executable script?

PR 20 is from a branch in the same repository, PR 56 is from a branch in a forked repository. The permissions difference is caused by the GITHUB_TOKEN from the forked repository not having sufficient permission to make changes to the source repository.

If that token did have permission to change the source repository, that would be a huge security problem, because then anyone could fork your repository and decide to e.g. delete the main branch. That's why my Action says it doesn't support previews from forks, even though there are ways around it. #6 has more details on this.