devicons / devicons/devicon

[BUG] The `in-develop` labeler is not working due to restricted `GITHUB_TOKEN` access

Open
#1,099 0 comments 0 reactions 1 assignee Claimed by @Snailedlt View on GitHub
bug devops
Dominant language
CSS
Stars
11.8k
Forks
2.4k
Avg merge
5d 4h
Merged PRs (30d)
3

Description

### I have searched through the issues and didn't find my problem.

- [X] Confirm

### Bug description

Currently, the in-develop issue labeler is not working properly (see [this](https://github.com/devicons/devicon/actions/runs/2032211622). The issue is due to the `GITHUB_TOKEN` being limited in scope when used in forked repos.
![image](https://user-images.githubusercontent.com/43018778/159856489-200669eb-7cd0-41ed-935e-2b9799d1fd99.png)

Since all PRs are from forked repos, it renders the workflow unable to edit the Issues in our repo.

### Possible fixes or solutions

I was going to try [this solution](https://github.com/actions/first-interaction/issues/10#issuecomment-1041402989). It involves giving the workflow access to these permissions to add the label. However, this is not recommended since our workflow involves checking out the repo => might open ourselves up to [pwn requests](https://securitylab.github.com/research/github-actions-preventing-pwn-requests/). It also seems like we can't override the access for forked repo as seen in this [link](https://docs.github.com/en/actions/security-guides/automatic-token-authentication#modifying-the-permissions-for-the-github_token)

New possible solution: follow the pattern that's being used by our `peek-bot`:
1. The `pull_request` PR saves the PR number/issue number into a file
2. Upload it as an artifact
3. Create a `workflow-run` workflow that runs after the first PR
4. Get the artifact and label our issue in here where we get full GITHUB_TOKEN access.

Since `workflow_run` workflows has to be in the default branch to work, this would prevent security issues.

### Additional information

For now, we can label or the issues manually after merging. It's a bit annoying but not too difficult.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.