Accessing organization secrets will raises error: Not Found in branches created by dependabot
Nobody has claimed this yet.
- Dominant language
- C#
- Stars
- 6.3k
- Forks
- 1.4k
- Avg merge
- 1d 16h
- Merged PRs (30d)
- 24
Description
Describe the bug
according to this post dependabot is now restricted to access secret. Accessing repo-secrets other than GITHUB_TOKEN will return empty value as I know, even the wrong reference like secrets.NOT_REPO_SECRET_NOR_ORG_SECRET too. however, with organization secrets is failed by Not Found error.
To Reproduce
Steps to reproduce the behavior:
- set organization secrets like
ORG_SECRET - setup dependabot to some projects with any outdated dependencies
- write some github actions refer to the secret created in step 1:
jobs:
jobname:
name: ***
runs-on: ubuntu-latest
steps:
- name: step1
uses: some-action
with:
SECRET: ${{ secrets.ORG_SECRET }}
Expected behavior
when some-action requires the input SECRET:
Run some-action@main
with:
Error: Input required and not supplied: SECRET
Runner Version and Platform
buntu-latest
What's not working?
Run some-action@main
with:
SECRET: ***
Error: Not Found
Job Log Output
2021-03-26T07:15:50.4384015Z ##[section]Starting: Request a runner to run this job
2021-03-26T07:15:51.0089606Z Can't find any online and idle self-hosted runner in current repository that matches the required labels: 'ubuntu-latest'
2021-03-26T07:15:51.0089695Z Can't find any online and idle self-hosted runner in current repository's account/organization that matches the required labels: 'ubuntu-latest'
2021-03-26T07:15:51.0090047Z Found online and idle hosted runner in current repository's account/organization that matches the required labels: 'ubuntu-latest'
2021-03-26T07:15:51.1399706Z ##[section]Finishing: Request a runner to run this job
2021-03-26T07:15:58.0918817Z Current runner version: '2.277.1'
2021-03-26T07:15:58.0948993Z ##[group]Operating System
2021-03-26T07:15:58.0949954Z Ubuntu
2021-03-26T07:15:58.0950515Z 20.04.2
2021-03-26T07:15:58.0950963Z LTS
2021-03-26T07:15:58.0951507Z ##[endgroup]
2021-03-26T07:15:58.0952138Z ##[group]Virtual Environment
2021-03-26T07:15:58.0952878Z Environment: ubuntu-20.04
2021-03-26T07:15:58.0953461Z Version: 20210318.0
2021-03-26T07:15:58.0954581Z Included Software: https://github.com/actions/virtual-environments/blob/ubuntu20/20210318.0/images/linux/Ubuntu2004-README.md
2021-03-26T07:15:58.0956055Z Image Release: https://github.com/actions/virtual-environments/releases/tag/ubuntu20%2F20210318.0
2021-03-26T07:15:58.0957074Z ##[endgroup]
2021-03-26T07:15:58.0959303Z ##[group]GITHUB_TOKEN Permissions
2021-03-26T07:15:58.0960617Z Actions: write
2021-03-26T07:15:58.0961234Z Checks: write
2021-03-26T07:15:58.0964831Z Contents: write
2021-03-26T07:15:58.0965554Z Deployments: write
2021-03-26T07:15:58.0966294Z Issues: write
2021-03-26T07:15:58.0966889Z Metadata: read
2021-03-26T07:15:58.0967538Z OrganizationPackages: write
2021-03-26T07:15:58.0968286Z Packages: write
2021-03-26T07:15:58.0968859Z PullRequests: write
2021-03-26T07:15:58.0969586Z RepositoryProjects: write
2021-03-26T07:15:58.0970267Z SecurityEvents: write
2021-03-26T07:15:58.0970860Z Statuses: write
2021-03-26T07:15:58.0971628Z ##[endgroup]
2021-03-26T07:15:58.0974928Z Prepare workflow directory
2021-03-26T07:15:58.1752691Z Prepare all required actions
2021-03-26T07:15:58.1764972Z Getting action download info
2021-03-26T07:15:58.5186738Z Download action repository '****************@main'
2021-03-26T07:16:00.9726109Z Download action repository '****************@main'
2021-03-26T07:16:01.4101712Z ##[group]Run ****************@main
2021-03-26T07:16:01.4102840Z with:
2021-03-26T07:16:01.4104107Z GITHUB_TOKEN: ***
2021-03-26T07:16:01.4104799Z ##[endgroup]
2021-03-26T07:16:03.9288898Z ##[error]Not Found
2021-03-26T07:16:03.9359037Z Cleaning up orphan processes
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
The issue names no repository file, test, or entry point. Start by reproducing the workflow with an organization secret on a Dependabot branch and compare the result with a repository-secret reference. Done means the organization-secret reference produces the expected missing-input behavior instead of a Not Found error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- csharp, github-actions
- Domain
- ci-cd
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100