How to upload assets on a draft release in GitHub Actions

[simonbrunel]

When trying to setup a GitHub Action to automatically upload assets (i.e. gh release upload) to a draft release on the same repository, the command fails with HTTP 404: Not Found. Executing this command locally works as expected, using a PAT with repo.public_repo. I can't find what are the scopes of the GITHUB_TOKEN provided by GitHub Actions but it looks like it doesn't allow this use case

Is it the expected behavior?

[mislav]

Hmm, your GITHUB_TOKEN should absolutely have the rights to update releases in the same repository. I don't know what's going on here.

You can try setting DEBUG=api environment variable during your job run to see the verbose log of HTTP traffic. Maybe it sheds some light on the mystery.

Can you upload assets to a draft release in that repository using gh release upload locally?

[simonbrunel]

It works locally yes. With DEBUG=api, I get the following (simplified) logs:

Locally:

> GET /repos/.../releases/tags/v0.7.0 HTTP/1.1
< HTTP/2.0 404 Not Found
< X-Accepted-Oauth-Scopes: repo
< X-Oauth-Scopes: public_repo

> POST /graphql HTTP/1.1
< HTTP/2.0 200 OK
< X-Accepted-Oauth-Scopes: repo
< X-Oauth-Scopes: public_repo
{
   "data": {
     "repository": {
        // ...
        "viewerPermission": "ADMIN",
        // ...
     }
   }
}

> GET /repos/.../releases?per_page=100&page=1 HTTP/1.1
< HTTP/2.0 200 OK
[
  // all releases (including draft).
]

> POST /repos/.../releases/35254447/assets?label=&name=....js HTTP/1.1
< HTTP/2.0 201 Created
{
  // the uploaded asset details
}

On GitHub Actions:

> GET /repos/.../releases/tags/v0.7.0 HTTP/1.1
< HTTP/2.0 404 Not Found

> POST /graphql HTTP/1.1
< HTTP/2.0 200 OK
{
   "data": {
     "repository": {
        // ...
        "viewerPermission": null,
        // ...
     }
   }
}

HTTP 404: Not Found (https://api.github.com/repos/.../releases/tags/v0.7.0)

- process terminated -

It's like if the command terminates before executing the /repos requests. I created simonbrunel/gh-release-upload to reproduce this issue (you first need to create a draft release for tag v0.1.0 and then manually trigger the Release workflow).

[mislav]

Thank you for the information!

It looks as if you are using a Personal Access Token too as GITHUB_TOKEN in Actions runs, not a generated token (${{secrets.GITHUB_TOKEN}}). Is that possible? The GITHUB_TOKEN in your Actions looks like it only has public_repo access, and your repo might be private.

[mislav]

Apologies. I should have first taken a deeper look into the reproduction repo that you shared. This is really helpful, thanks! It looks like a bug when it comes to uploading to draft releases: #3037

A temporary workaround would be to manually generate a PAT and save it in your repository's secrets.

[simonbrunel]

Thank you @mislav, I'm going to use a generated PAT until it's fixed.