Error: Resource not accessible by integration

[vorburger]

https://github.com/www-learn-study/saraswati.learn.study/actions/runs/6728789654/job/18288641496?pr=49 for #49 has:

Run echo "url=https://www-learn-study.github.io/previews/pr-preview/pr-49/"  >> $GITHUB_OUTPUT
Run marocchino/sticky-pull-request-comment@v2
Error: Resource not accessible by integration

[vorburger]

I investigated (the previous occurence of) this tonight, pro memoria:

• Error: unexpected error encountered: HttpError: Resource not accessible by integration - see logs for more information EndBug/pages-preview#20
• Error: Resource not accessible by integration rossjrw/pr-preview-action#60

[vorburger]

#43 with the correct permissions: DID fix it earlier, what happened?!

[vorburger]

Duh, I'm stupid - I had removed permissions: issues: write in #46, with other changes (unrelated, bad idea).

[vorburger]

OMG, will this never end... despite #51 to revert (part of) #46, https://github.com/www-learn-study/saraswati.learn.study/actions/runs/6728895504/job/18288916361?pr=49 still failed?! Now why is that...

[vorburger]

It worked in #52.

So I think this is similar to #30? Specific to when there are changes on .github/workflows/ in a PR, then (only) this happens.

It's probably security related. Security is hard. I don't know if (but suspect that yes) workflows: write as in #31 may solve this, but again, not entirely being clear about the security implications, let's not.

I'll see if instead I can skip preview if /workflows/ were touched.

[vorburger]

#53 did the trick, and #49 was green with that.

Resolving.

[vorburger]

OMG!!! This re-appears in https://github.com/www-learn-study/saraswati.learn.study/actions/runs/6729181928/job/18289629818?pr=20, as:

Request POST /repos/www-learn-study/saraswati.learn.study/issues/20/comments failed with 403: Forbidden
Request POST /repos/www-learn-study/saraswati.learn.study/issues/20/comments failed with 403: Forbidden
[GitHub Comment Reporter] Unable to post pull request comment: 403 {"message": "Resource not accessible by integration", "documentation_url": "https://docs.github.com/rest/issues/comments#create-an-issue-comment"}.
To enable this function, please add permissions in your Github Actions Workflow:
permissions:
  issues: write
  pull-requests: write

It looks like #28 broke that. I don't understand how these different permissions: at the top and inside jobs: interact.

[vorburger]

It looks like #28 broke that. I don't understand how these different permissions: at the top and inside jobs: interact.

Or did it? Because #54 didn't fixed this, and Mega Linter still hasn't posted a comment on #20; still same problem on https://github.com/www-learn-study/saraswati.learn.study/actions/runs/6729277897/job/18289890568?pr=20.

Keeping this issue open to further re-investigate another time.

[vorburger]

Meta Linter did now post (again), to #55.

However, now the original problem is back in https://github.com/www-learn-study/saraswati.learn.study/actions/runs/6729470600/job/18290395773?pr=20 for #20.

This is insane!

[vorburger]

However on #56 it works. This makes no sense.

And cherry-picking #20 into a new #57 reproduces the problem (and it affects Mega Linter as well, on both), and also has:

/usr/bin/git push --porcelain ***github.com/www-learn-study/previews.git github-pages-deploy-action/2vtdhi3m1:gh-pages
remote: Invalid username or password.
fatal: Authentication failed for 'https://github.com/www-learn-study/previews.git/'

What's the difference between #20 and #56 that's causing this?! It's probably some security related thing? The change in an executable script?

[vorburger]

The change in an executable script?

Yup, that's it; apparently! Note the trivial change in #58 has the same problem.

[AbraaoAlves]

It's looks like an unauthorized user email trying to push to your branch:
https://github.com/www-learn-study/saraswati.learn.study/actions/runs/6728789654/job/18288641496?pr=49#step:4:134

I've got the same problem using PAT (personal access token). Maybe, this PR can help us given the possibility to config user and email for this PAT:

rossjrw/pr-preview-action#32