Permission denied when "Deleting the contents of"

[soasada]

Hi checkout team,

I'm having an issue when actions/checkout@v2 is trying to delete the repository:

I tried to change the permissions of the file but still happening, this has been happening since yesterday. I think that could be a bug but correct me if I'm wrong.

My .github/workflow/docker.yml is like this:

name: MorciTravel CI

on: [push]

jobs:

  morcitravel_job:
    name: Morcitravel job
    runs-on: ubuntu-latest
    env:
      KILL_JAVA_SH: ${{ github.workspace }}/ci/kill_java_process.sh
      SERVER_PUB_KEY: ${{ github.workspace }}/data/server/server_pub_key.txt
      JAVA_CMD_PATH: /opt/prod_jdk/bin/java
      JAR_NAME: morci-travel-api-
    services:
      mongodb:
        image: mongo:4-bionic
        ports:
          - 27017:27017
        volumes:
          - ${{ github.workspace }}/data/mongo/001_users.js:/docker-entrypoint-initdb.d/001_users.js
    steps:
      - name: Check out repository
        uses: actions/checkout@v2
      - name: Set up JDK 13
        uses: actions/setup-java@v1
        with:
          java-version: 13
      - name: Test & Package frontend
        run: mvn -B clean install -pl :morci-travel-frontend
      - name: Create version
        run: |
          APP_RELEASE_VERSION=$(mvn help:evaluate -Dexpression=project.version -q -DforceStdout)
          APP_RELEASE_VERSION_ARRAY=(${APP_RELEASE_VERSION//./ })
          ((APP_RELEASE_VERSION_ARRAY[2]++))
          APP_RELEASE_VERSION="${APP_RELEASE_VERSION_ARRAY[0]}.${APP_RELEASE_VERSION_ARRAY[1]}.${APP_RELEASE_VERSION_ARRAY[2]}"
          echo "::set-env name=JAR_NAME::$JAR_NAME$APP_RELEASE_VERSION-SNAPSHOT.jar"
          mvn -B --batch-mode release:update-versions -DdevelopmentVersion=$APP_RELEASE_VERSION-SNAPSHOT
      - name: Test & Package backend
        run: mvn -B clean test package -pl :morci-travel-api
      - name: Prepare SSH Keys
        run: |
          mkdir -p ~/.ssh
          echo "${{ secrets.KEY }}" > ~/.ssh/id_rsa
          chmod 600 ~/.ssh/id_rsa
          cat "$SERVER_PUB_KEY" > ~/.ssh/known_hosts
          chmod 600 ~/.ssh/known_hosts
      - name: Kill java process
        run: |
          ssh -p ${{ secrets.PORT }} ${{ secrets.USERNAME }}@${{ secrets.HOST }} 'bash -s' < $KILL_JAVA_SH
      - name: Remove old artifacts
        run: |
          ssh -p ${{ secrets.PORT }} ${{ secrets.USERNAME }}@${{ secrets.HOST }} "rm -rf morci-travel-api-*.jar"
      - name: Copy jar to server
        run: |
          scp -P ${{ secrets.PORT }} ${{ github.workspace }}/morci-travel-api/target/$JAR_NAME ${{ secrets.USERNAME }}@${{ secrets.HOST }}:~
      - name: Launch app
        run: |
          ssh -f -p ${{ secrets.PORT }} ${{ secrets.USERNAME }}@${{ secrets.HOST }} "$JAVA_CMD_PATH -Xms64M -Xmx256M -jar $JAR_NAME &"
      - name: Commit version
        run: |
          git config --global user.name 'Nicolas Vargas Ortega'
          git config --global user.email 'soasada@users.noreply.github.com'
          git commit -am "AUTOMATIC: Updated version"
          git push

[ericsciple]

You may need to specify the checkout path input to avoid the volume mount being under the repository.

The containers are setup at the beginning of the job. And git clone will fail if the directory isnt empty.

You could always symlink the dir back in place (or copy the files), if you need the data underneath the repository. Or if it's your test data, consider updating your scripts to allow the location to be overridden using an env var.

[soasada]

You may need to specify the checkout path input to avoid the volume mount being under the repository.

The containers are setup at the beginning of the job. And git clone will fail if the directory isnt empty.

You could always symlink the dir back in place (or copy the files), if you need the data underneath the repository. Or if it's your test data, consider updating your scripts to allow the location to be overridden using an env var.

I just removed the service and is working again. The thing is that I was able to use the script without problems (with the service) in the past.

So AFAIK, the problem is that the service mount the volume before the github checkout and this create a existing file with the same name (I guess) and github/checkoutv2 cannot remove it, right?

[jeremylynch]

I experienced the same issue. To get around this I ran a command to change file permissions right before executing actions/checkout:

sudo chown -R $USER:$USER /home/github/actions-runner/_work/{REPOSITORY_NAME_HERE}

[ericsciple]

I'm going to add a troubleshooting doc. I'll add a section for this.

[karancode]

Thank you for reporting this,. I am also facing the same issue.. But I still couldn't figure out a way to resolve this. Please help.

[soasada]

Thank you for reporting this,. I am also facing the same issue.. But I still couldn't figure out a way to resolve this. Please help.

Could you take a look at @jeremylynch response?

[zpsjs]

I had to add "echo password" before, otherwise sudo is asking for password.

echo ${{secrets.DEPLOY_PASSWORD}} | sudo -S chown -R $USER:$USER /home/github/deployment/{REPOSITORY_NAME_HERE}

Is there a better solution?

[guykeller]

@ericsciple I have encountered a similar issue, but have not been able to sort it using the suggested solution by @jeremylynch.

We're getting this error when using this action:

And secrets.Nothing contains our PAT, which should be valid (defined for a user that has access to the repo, saved as a secret in the repo).
Moreover, I've tried adding the permissions as suggested above, removing the token field, and using several different endpoints.

Important note - the same flow works without using the container, and the checkout is successful.

Any idea as to what the problem might be? I'll appreciate any advice

[JungHanter]

@guykeller Is it solved? I have same problem when initialzing the repository

[ekahannes]

Also having the same issue if I use a container.