Which permissions/scopes needed for PAT?

[jezdez]

I was wondering if you could document which permissions (scopes) should be selected when creating a PAT for this action?

[BetaHuhn]

Hey @jezdez,

The Action needs to be able to read and write to a repo and create/modify a PR. To my knowledge there's no way to select only those two, so you need the full repo scope:

Hope this helps, let me know if you have any other questions!

[BetaHuhn]

Sure, added in d23bb51!

[fzyzcjy]

Hi this seems to be a bit too much... Must I have these permission for public repo?

[BetaHuhn]

The Action needs to be able to create a PR in the target repo and access the contents of the source and target repository. I don't know if it would work with less permissions on a public repository.

Technically you don't need the repo:invite and security_events scope though.

[dimisjim]

seems that it needs the workflow scope too, if one wants to sync files under .github/workflows:

(refusing to allow a Personal Access Token to create or update workflow .github/workflows/someWorkflow.yaml without workflow scope)

[finkedave]

Thought this would be a good place to follow up on this question, just in case others have the same issue. I followed the instructions and gave my Personal Access Token full privileges and tried to run the action. It clones the repos, it has no problem creating the branch and pushing it to the repos when i turn off OVERWRITE_EXISTING_PR: false (this makes it skip pulling down PRs)

But it errors when it tries to pull the PRs when OVERWRITE_EXISTING_PR: true and when trying to actually make the PR. 'Error Bad Credentials' in both cases

My repos has 'Allow Github Action to Create and Approve Pull Requests' turned on and checked my organization settings and didn't see anything that would disable PR from being made.

Does anyone have any idea what else could be the issue. Thanks