danger / danger/danger-js

Github Action fails when PR comes from forked repo

Open
#918 22 comments 3 reactions 0 assignees View on GitHub
[platform] GitHub
Dominant language
TypeScript
Stars
5.5k
Forks
381
Avg merge
2h 8m
Merged PRs (30d)
6

Description

## Problem

Danger crashes when I accept a PR from the fork: https://github.com/sobolevn/itmo-2019/pull/18/checks?check_run_id=222332195

But, works well when I create PRs inside the repo: https://github.com/sobolevn/itmo-2019/pulls?q=is%3Apr+is%3Aclosed (just an example).

My configuration:

```yaml
name: comments

on: [pull_request]

jobs:
danger:

runs-on: ubuntu-latest

steps:
- uses: actions/checkout@master
- name: Danger JS Action
uses: danger/danger-js@9.1.8
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
```

Link: https://github.com/sobolevn/itmo-2019/blob/master/.github/workflows/review.yml

## Output

```
Danger JS Action5s
##[error]Docker run failed with exit code 1
Run danger/danger-js@9.1.8
env:
GITHUB_TOKEN: ***
/usr/bin/docker run --name df7dcddf0fc01b57b4276b942607159610154_53cda2 --label 0df7dc --workdir /github/workspace --rm -e GITHUB_TOKEN -e HOME -e GITHUB_REF -e GITHUB_SHA -e GITHUB_REPOSITORY -e GITHUB_ACTOR -e GITHUB_WORKFLOW -e GITHUB_HEAD_REF -e GITHUB_BASE_REF -e GITHUB_EVENT_NAME -e GITHUB_WORKSPACE -e GITHUB_ACTION -e GITHUB_EVENT_PATH -e RUNNER_OS -e RUNNER_TOOL_CACHE -e RUNNER_TEMP -e RUNNER_WORKSPACE -v "/var/run/docker.sock":"/var/run/docker.sock" -v "/home/runner/work/_temp/_github_home":"/github/home" -v "/home/runner/work/_temp/_github_workflow":"/github/workflow" -v "/home/runner/work/itmo-2019/itmo-2019":"/github/workspace" 0df7dc:ddf0fc01b57b4276b942607159610154

Failing the build, there is 1 fail.
Request failed [403]: https://api.github.com/repos/sobolevn/itmo-2019/issues/18/comments
Response: {
"message": "Resource not accessible by integration",
"documentation_url": "https://developer.github.com/v3/issues/comments/#create-a-comment"
}
Feedback: undefined
##[error]Docker run failed with exit code 1
```

Image (in case output it is easier to read):

Снимок экрана 2019-09-14 в 22 11 00

## Possible reason

I guess that this is possibly related with how `GITHUB_TOKEN` works for forked repos: https://help.github.com/en/articles/virtual-environments-for-github-actions#github_token-secret

Снимок экрана 2019-09-14 в 22 12 13

And I have no ideas, how to fix it. [Official docs] do not say much about this problem: https://danger.systems/js/guides/getting_started.html#setting-up-danger-to-run-on-your-ci Moreover, I cannot find any other real-world usage of `danger-js` as an action. So, I cannot verify that it also happens to other users as well.

Any ideas where to look?

Contributor guide

Open the contributing guide

Research direction

Start with .github/workflows/review.yml and the danger/danger-js@9.1.8 action configuration, then compare its behavior for forked and same-repository pull requests. Inspect the request to the GitHub issue-comments endpoint and the documented GITHUB_TOKEN permissions. Done means the workflow handles forked pull requests without the reported 403 failure.

Written by the indexing model from the issue text.

Assessment

Tech stack
github-actions, typescript
Domain
api, ci-cd, devops
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.