Github Action fails when PR comes from forked repo
- Dominant language
- TypeScript
- Stars
- 5.5k
- Forks
- 381
- Avg merge
- 2h 8m
- Merged PRs (30d)
- 6
Description
## Problem
Danger crashes when I accept a PR from the fork: https://github.com/sobolevn/itmo-2019/pull/18/checks?check_run_id=222332195
But, works well when I create PRs inside the repo: https://github.com/sobolevn/itmo-2019/pulls?q=is%3Apr+is%3Aclosed (just an example).
My configuration:
```yaml
name: comments
on: [pull_request]
jobs:
danger:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@master
- name: Danger JS Action
uses: danger/danger-js@9.1.8
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
```
Link: https://github.com/sobolevn/itmo-2019/blob/master/.github/workflows/review.yml
## Output
```
Danger JS Action5s
##[error]Docker run failed with exit code 1
Run danger/danger-js@9.1.8
env:
GITHUB_TOKEN: ***
/usr/bin/docker run --name df7dcddf0fc01b57b4276b942607159610154_53cda2 --label 0df7dc --workdir /github/workspace --rm -e GITHUB_TOKEN -e HOME -e GITHUB_REF -e GITHUB_SHA -e GITHUB_REPOSITORY -e GITHUB_ACTOR -e GITHUB_WORKFLOW -e GITHUB_HEAD_REF -e GITHUB_BASE_REF -e GITHUB_EVENT_NAME -e GITHUB_WORKSPACE -e GITHUB_ACTION -e GITHUB_EVENT_PATH -e RUNNER_OS -e RUNNER_TOOL_CACHE -e RUNNER_TEMP -e RUNNER_WORKSPACE -v "/var/run/docker.sock":"/var/run/docker.sock" -v "/home/runner/work/_temp/_github_home":"/github/home" -v "/home/runner/work/_temp/_github_workflow":"/github/workflow" -v "/home/runner/work/itmo-2019/itmo-2019":"/github/workspace" 0df7dc:ddf0fc01b57b4276b942607159610154
Failing the build, there is 1 fail.
Request failed [403]: https://api.github.com/repos/sobolevn/itmo-2019/issues/18/comments
Response: {
"message": "Resource not accessible by integration",
"documentation_url": "https://developer.github.com/v3/issues/comments/#create-a-comment"
}
Feedback: undefined
##[error]Docker run failed with exit code 1
```
Image (in case output it is easier to read):

## Possible reason
I guess that this is possibly related with how `GITHUB_TOKEN` works for forked repos: https://help.github.com/en/articles/virtual-environments-for-github-actions#github_token-secret

And I have no ideas, how to fix it. [Official docs] do not say much about this problem: https://danger.systems/js/guides/getting_started.html#setting-up-danger-to-run-on-your-ci Moreover, I cannot find any other real-world usage of `danger-js` as an action. So, I cannot verify that it also happens to other users as well.
Any ideas where to look?
Contributor guide
Research direction
Start with .github/workflows/review.yml and the danger/danger-js@9.1.8 action configuration, then compare its behavior for forked and same-repository pull requests. Inspect the request to the GitHub issue-comments endpoint and the documented GITHUB_TOKEN permissions. Done means the workflow handles forked pull requests without the reported 403 failure.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- github-actions, typescript
- Domain
- api, ci-cd, devops
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100