actions / actions/runner

Accessing organization secrets will raises error: Not Found in branches created by dependabot

Open
#1,025 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug needs-investigation
Dominant language
C#
Stars
6.3k
Forks
1.4k
Avg merge
1d 16h
Merged PRs (30d)
24

Description

Describe the bug

according to this post dependabot is now restricted to access secret. Accessing repo-secrets other than GITHUB_TOKEN will return empty value as I know, even the wrong reference like secrets.NOT_REPO_SECRET_NOR_ORG_SECRET too. however, with organization secrets is failed by Not Found error.

To Reproduce
Steps to reproduce the behavior:

  1. set organization secrets like ORG_SECRET
  2. setup dependabot to some projects with any outdated dependencies
  3. write some github actions refer to the secret created in step 1:
jobs:
  jobname:
    name: ***
    runs-on: ubuntu-latest
    steps:
      - name: step1
        uses: some-action
        with:
          SECRET: ${{ secrets.ORG_SECRET }}

Expected behavior

when some-action requires the input SECRET:

Run some-action@main
  with:
Error: Input required and not supplied: SECRET

Runner Version and Platform

buntu-latest

What's not working?

Run some-action@main
  with:
    SECRET: ***
Error: Not Found

Job Log Output

2021-03-26T07:15:50.4384015Z ##[section]Starting: Request a runner to run this job
2021-03-26T07:15:51.0089606Z Can't find any online and idle self-hosted runner in current repository that matches the required labels: 'ubuntu-latest'
2021-03-26T07:15:51.0089695Z Can't find any online and idle self-hosted runner in current repository's account/organization that matches the required labels: 'ubuntu-latest'
2021-03-26T07:15:51.0090047Z Found online and idle hosted runner in current repository's account/organization that matches the required labels: 'ubuntu-latest'
2021-03-26T07:15:51.1399706Z ##[section]Finishing: Request a runner to run this job
2021-03-26T07:15:58.0918817Z Current runner version: '2.277.1'
2021-03-26T07:15:58.0948993Z ##[group]Operating System
2021-03-26T07:15:58.0949954Z Ubuntu
2021-03-26T07:15:58.0950515Z 20.04.2
2021-03-26T07:15:58.0950963Z LTS
2021-03-26T07:15:58.0951507Z ##[endgroup]
2021-03-26T07:15:58.0952138Z ##[group]Virtual Environment
2021-03-26T07:15:58.0952878Z Environment: ubuntu-20.04
2021-03-26T07:15:58.0953461Z Version: 20210318.0
2021-03-26T07:15:58.0954581Z Included Software: https://github.com/actions/virtual-environments/blob/ubuntu20/20210318.0/images/linux/Ubuntu2004-README.md
2021-03-26T07:15:58.0956055Z Image Release: https://github.com/actions/virtual-environments/releases/tag/ubuntu20%2F20210318.0
2021-03-26T07:15:58.0957074Z ##[endgroup]
2021-03-26T07:15:58.0959303Z ##[group]GITHUB_TOKEN Permissions
2021-03-26T07:15:58.0960617Z Actions: write
2021-03-26T07:15:58.0961234Z Checks: write
2021-03-26T07:15:58.0964831Z Contents: write
2021-03-26T07:15:58.0965554Z Deployments: write
2021-03-26T07:15:58.0966294Z Issues: write
2021-03-26T07:15:58.0966889Z Metadata: read
2021-03-26T07:15:58.0967538Z OrganizationPackages: write
2021-03-26T07:15:58.0968286Z Packages: write
2021-03-26T07:15:58.0968859Z PullRequests: write
2021-03-26T07:15:58.0969586Z RepositoryProjects: write
2021-03-26T07:15:58.0970267Z SecurityEvents: write
2021-03-26T07:15:58.0970860Z Statuses: write
2021-03-26T07:15:58.0971628Z ##[endgroup]
2021-03-26T07:15:58.0974928Z Prepare workflow directory
2021-03-26T07:15:58.1752691Z Prepare all required actions
2021-03-26T07:15:58.1764972Z Getting action download info
2021-03-26T07:15:58.5186738Z Download action repository '****************@main'
2021-03-26T07:16:00.9726109Z Download action repository '****************@main'
2021-03-26T07:16:01.4101712Z ##[group]Run ****************@main
2021-03-26T07:16:01.4102840Z with:
2021-03-26T07:16:01.4104107Z   GITHUB_TOKEN: ***
2021-03-26T07:16:01.4104799Z ##[endgroup]
2021-03-26T07:16:03.9288898Z ##[error]Not Found
2021-03-26T07:16:03.9359037Z Cleaning up orphan processes

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

The issue names no repository file, test, or entry point. Start by reproducing the workflow with an organization secret on a Dependabot branch and compare the result with a repository-secret reference. Done means the organization-secret reference produces the expected missing-input behavior instead of a Not Found error.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp, github-actions
Domain
ci-cd
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.