Accessing draft releases is not possible in GitHub runners using gh release list

[juanjjaramillo]

Describe the bug

The output of gh release list does not list draft releases when run on GitHub runners.

Steps to reproduce the behavior

On a GitHub runner, run the following command on a workflow:

gh release list

Expected vs actual behavior

Expected output

Here is the output when command is run on MacOS Sonoma 14.4.1 on an Apple M1 Max chip:

$ gh --version 
gh version 2.49.1 (2024-05-08)
https://github.com/cli/cli/releases/tag/v2.49.1

$ gh release list
TITLE                      TYPE    TAG NAME                   PUBLISHED       
v0.1.0                     Draft   v0.1.0                     about 2 days ago
k8s-agents-operator-0.0.0  Latest  k8s-agents-operator-0.0.0  about 2 days ago

Actual output

GitHub runner environment:

Current runner version: '2.316.1'
Operating System
  Ubuntu
  [2](https://github.com/newrelic/k8s-agents-operator/actions/runs/9062498302/job/24896492553#step:1:2)2.04.4
  LTS
Runner Image
  Image: ubuntu-22.04
  Version: 20240422.1.0
  Included Software: https://github.com/actions/runner-images/blob/ubuntu22/20240422.1/images/ubuntu/Ubuntu2204-Readme.md
  Image Release: https://github.com/actions/runner-images/releases/tag/ubuntu22%2F20240422.1
Runner Image Provisioner
  2.0.[3](https://github.com/newrelic/k8s-agents-operator/actions/runs/9062498302/job/24896492553#step:1:3)69.1
GITHUB_TOKEN Permissions
  Contents: write
  Metadata: read
Secret source: Actions
Prepare workflow directory
Prepare all required actions
Getting action download info
Download action repository 'actions/checkout@[4](https://github.com/newrelic/k8s-agents-operator/actions/runs/9062498302/job/24896492553#step:1:4)4c2b7a8a4ea60a981eaca3cf939b[5](https://github.com/newrelic/k8s-agents-operator/actions/runs/9062498302/job/24896492553#step:1:5)f4305c123b' (SHA:44c2b7a8a4ea[6](https://github.com/newrelic/k8s-agents-operator/actions/runs/9062498302/job/24896492553#step:1:7)0a981eaca3cf939b5f4305c123b)

Actual output:

Run echo "$( gh release list )"
  echo "$( gh release list )"
  shell: /usr/bin/bash -e {0}
  env:
    GITHUB_TOKEN: ***
k8s-agents-operator-0.0.0	Latest	k8s-agents-operator-0.0.0	2024-05-10T22:52:56Z

[andyfeller]

@juanjjaramillo : sorry to hear about the inconsistent experience; let's see if we can get to the bottom of what is going on! 👍

Are there any limitations to the Release REST API endpoints being used?

The code in question is based around pulling this data from GraphQL:

cli/pkg/cmd/release/list/http.go

Lines 38 to 49 in e14f0d7

	func fetchReleases(httpClient *http.Client, repo ghrepo.Interface, limit int, excludeDrafts bool, excludePreReleases bool, order string) ([]Release, error) {
	type responseData struct {
	Repository struct {
	Releases struct {
	Nodes []Release
	PageInfo struct {
	HasNextPage bool
	EndCursor string
	}
	} `graphql:"releases(first: $perPage, orderBy: {field: CREATED_AT, direction: $direction}, after: $endCursor)"`
	} `graphql:"repository(owner: $owner, name: $name)"`
	}

Looking at the Repository GraphQL object documentation, it doesn't state any limitations. However, the "List releases" REST endpoint sheds some light on whats going on:

Information about published releases are available to everyone. Only users with push access will receive listings for draft releases.

@juanjjaramillo: What happens if you give the runner the ability to write releases?

[juanjjaramillo]

Thank you @andyfeller for taking a look at the issue. Right now these are the current permissions we have:

GITHUB_TOKEN Permissions
  Contents: write
  Metadata: read

I thought that giving Contents: write is the correct permission for creating releases, please let me know if I have to add additional permissions to the token.

[juanjjaramillo]

@andyfeller please let me know what to do next. As I mentioned above, I think we already have the needed permissions and the problem is still happening