Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

PAT tokens unable to add to merge a PR with the merge queue #8352

Open
mhemmings opened this issue Nov 18, 2023 · 34 comments
Open

PAT tokens unable to add to merge a PR with the merge queue #8352

mhemmings opened this issue Nov 18, 2023 · 34 comments
Labels
bug Something isn't working p2 Affects more than a few users but doesn't prevent core functions platform Problems with the GitHub platform rather than the CLI client

Comments

@mhemmings
Copy link

Describe the bug

gh version 2.39.1 (2023-11-14)

The following command gives strange behaviour when using a PAT (fine-grained) token:

gh pr merge --auto "$PR_URL"

The CLI takes you through normal merge steps as if there is no merge queue, and then fails at the end.

However, running the same command in Github Actions with a GITHUB_TOKEN, the command succeeds as expected and the PR gets added to the merge queue.

May be related to #7213, though not quite the same issue I don't think

Steps to reproduce the behavior

  1. Auth with GH CLI with a PAT (fine-grained) token
  2. For a PR in a repository with a merge queue enforced, run gh pr merge --auto "$PR_URL"
  3. Rather than adding the PR to the merge queue, the CLI goes through the steps of: "What merge method would you like to use?", "Delete the branch on GitHub?", and "What's next?"
  4. Go through these steps, and the following error is shown GraphQL: Changes must be made through the merge queue (mergePullRequest)

Expected vs actual behavior

As per the docs, the PR should be added to the merge queue. This works as expected when running in Github Actions with a GITHUB_TOKEN, but the above error happens with a PAT.

@mhemmings mhemmings added the bug Something isn't working label Nov 18, 2023
@cliAutomation cliAutomation added the needs-triage needs to be reviewed label Nov 18, 2023
@andrew-garland
Copy link

andrew-garland commented Nov 19, 2023

Not sure if setting --auto on a PR is the same as working with the merge queue.

However, I was having failures trying to set a PR to be configured from auto-merge using fine grained token. The same token successfully approves the PRs.

With the help of https://github.com/orgs/community/discussions/24686 i was able to get it working by adding Contents read/write to the allowed permissions of the fine grained token. Seems excessive to me for my use case.

image

@mhemmings
Copy link
Author

The PAT I'm using has these permissions. Definitely excessive!

Screenshot 2023-11-20 at 06 34 16

@williammartin
Copy link
Member

Hey @mhemmings, thanks for raising the issue. That sounds pretty annoying.

Could you provide the output with GH_DEBUG=api enabled? Thanks!

@williammartin williammartin added needs-user-input and removed needs-triage needs to be reviewed labels Nov 24, 2023
@mhemmings
Copy link
Author

Hi @williammartin, he's the debug output:

gh pr merge --auto "$PR_URL"

⣾* Request at 2023-11-29 17:43:25.875218 +0000 GMT m=+0.069728085
* Request to https://api.github.com/graphql
> POST /graphql HTTP/1.1
> Host: api.github.com
> Accept: application/vnd.github.merge-info-preview+json, application/vnd.github.nebula-preview
> Authorization: token ████████████████████
> Content-Length: 248
> Content-Type: application/json
> Graphql-Features: merge_queue
> Time-Zone: Europe/London
> User-Agent: GitHub CLI 2.39.1
> X-Gh-Cache-Ttl: 24h0m0s

{
  "query": "query PullRequest_fields{PullRequest: __type(name: \"PullRequest\"){fields(includeDeprecated: true){name}},StatusCheckRollupContextConnection: __type(name: \"StatusCheckRollupContextConnection\"){fields(includeDeprecated: true){name}}}"
}

< HTTP/2.0 200 OK
< Access-Control-Allow-Origin: *
< Access-Control-Expose-Headers: ETag, Link, Location, Retry-After, X-GitHub-OTP, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Used, X-RateLimit-Resource, X-RateLimit-Reset, X-OAuth-Scopes, X-Accepted-OAuth-Scopes, X-Poll-Interval, X-GitHub-Media-Type, X-GitHub-SSO, X-GitHub-Request-Id, Deprecation, Sunset
< Content-Security-Policy: default-src 'none'
< Content-Type: application/json; charset=utf-8
< Date: Wed, 29 Nov 2023 17:39:03 GMT
< Github-Authentication-Token-Expiration: 2024-01-01 00:00:00 +0000
< Referrer-Policy: origin-when-cross-origin, strict-origin-when-cross-origin
< Server: GitHub.com
< Strict-Transport-Security: max-age=31536000; includeSubdomains; preload
< Vary: Accept-Encoding, Accept, X-Requested-With
< X-Content-Type-Options: nosniff
< X-Frame-Options: deny
< X-Github-Media-Type: github.merge-info-preview; param=nebula-preview; format=json
< X-Github-Request-Id: E3DC:1938:1A438C5B:1A93F45B:65677737
< X-Ratelimit-Limit: 5000
< X-Ratelimit-Remaining: 4997
< X-Ratelimit-Reset: 1701283132
< X-Ratelimit-Resource: graphql
< X-Ratelimit-Used: 3
< X-Xss-Protection: 0

{
  "data": {
    "PullRequest": {
      "fields": [
        {
          "name": "activeLockReason"
        },
        {
          "name": "additions"
        },
        {
          "name": "assignees"
        },
        {
          "name": "author"
        },
        {
          "name": "authorAssociation"
        },
        {
          "name": "autoMergeRequest"
        },
        {
          "name": "baseRef"
        },
        {
          "name": "baseRefName"
        },
        {
          "name": "baseRefOid"
        },
        {
          "name": "baseRepository"
        },
        {
          "name": "body"
        },
        {
          "name": "bodyHTML"
        },
        {
          "name": "bodyText"
        },
        {
          "name": "canBeRebased"
        },
        {
          "name": "changedFiles"
        },
        {
          "name": "checksResourcePath"
        },
        {
          "name": "checksUrl"
        },
        {
          "name": "closed"
        },
        {
          "name": "closedAt"
        },
        {
          "name": "closingIssuesReferences"
        },
        {
          "name": "comments"
        },
        {
          "name": "commits"
        },
        {
          "name": "createdAt"
        },
        {
          "name": "createdViaEmail"
        },
        {
          "name": "databaseId"
        },
        {
          "name": "deletions"
        },
        {
          "name": "editor"
        },
        {
          "name": "files"
        },
        {
          "name": "headRef"
        },
        {
          "name": "headRefName"
        },
        {
          "name": "headRefOid"
        },
        {
          "name": "headRepository"
        },
        {
          "name": "headRepositoryOwner"
        },
        {
          "name": "hovercard"
        },
        {
          "name": "id"
        },
        {
          "name": "includesCreatedEdit"
        },
        {
          "name": "isCrossRepository"
        },
        {
          "name": "isDraft"
        },
        {
          "name": "isReadByViewer"
        },
        {
          "name": "labels"
        },
        {
          "name": "lastEditedAt"
        },
        {
          "name": "latestOpinionatedReviews"
        },
        {
          "name": "latestReviews"
        },
        {
          "name": "locked"
        },
        {
          "name": "maintainerCanModify"
        },
        {
          "name": "mergeCommit"
        },
        {
          "name": "mergeQueueEntry"
        },
        {
          "name": "mergeStateStatus"
        },
        {
          "name": "mergeable"
        },
        {
          "name": "merged"
        },
        {
          "name": "mergedAt"
        },
        {
          "name": "mergedBy"
        },
        {
          "name": "milestone"
        },
        {
          "name": "number"
        },
        {
          "name": "participants"
        },
        {
          "name": "permalink"
        },
        {
          "name": "potentialMergeCommit"
        },
        {
          "name": "projectCards"
        },
        {
          "name": "projectItems"
        },
        {
          "name": "projectV2"
        },
        {
          "name": "projectsV2"
        },
        {
          "name": "publishedAt"
        },
        {
          "name": "reactionGroups"
        },
        {
          "name": "reactions"
        },
        {
          "name": "repository"
        },
        {
          "name": "resourcePath"
        },
        {
          "name": "revertResourcePath"
        },
        {
          "name": "revertUrl"
        },
        {
          "name": "reviewDecision"
        },
        {
          "name": "reviewRequests"
        },
        {
          "name": "reviewThreads"
        },
        {
          "name": "reviews"
        },
        {
          "name": "state"
        },
        {
          "name": "suggestedReviewers"
        },
        {
          "name": "timeline"
        },
        {
          "name": "timelineItems"
        },
        {
          "name": "title"
        },
        {
          "name": "titleHTML"
        },
        {
          "name": "totalCommentsCount"
        },
        {
          "name": "updatedAt"
        },
        {
          "name": "url"
        },
        {
          "name": "userContentEdits"
        },
        {
          "name": "viewerCanApplySuggestion"
        },
        {
          "name": "viewerCanClose"
        },
        {
          "name": "viewerCanDeleteHeadRef"
        },
        {
          "name": "viewerCanDisableAutoMerge"
        },
        {
          "name": "viewerCanEditFiles"
        },
        {
          "name": "viewerCanEnableAutoMerge"
        },
        {
          "name": "viewerCanMergeAsAdmin"
        },
        {
          "name": "viewerCanReact"
        },
        {
          "name": "viewerCanReopen"
        },
        {
          "name": "viewerCanSubscribe"
        },
        {
          "name": "viewerCanUpdate"
        },
        {
          "name": "viewerCanUpdateBranch"
        },
        {
          "name": "viewerCannotUpdateReasons"
        },
        {
          "name": "viewerDidAuthor"
        },
        {
          "name": "viewerLatestReview"
        },
        {
          "name": "viewerLatestReviewRequest"
        },
        {
          "name": "viewerMergeBodyText"
        },
        {
          "name": "viewerMergeHeadlineText"
        },
        {
          "name": "viewerSubscription"
        }
      ]
    },
    "StatusCheckRollupContextConnection": {
      "fields": [
        {
          "name": "checkRunCount"
        },
        {
          "name": "checkRunCountsByState"
        },
        {
          "name": "edges"
        },
        {
          "name": "nodes"
        },
        {
          "name": "pageInfo"
        },
        {
          "name": "statusContextCount"
        },
        {
          "name": "statusContextCountsByState"
        },
        {
          "name": "totalCount"
        }
      ]
    }
  }
}

* Request took 1.076833ms
* Request at 2023-11-29 17:43:25.882578 +0000 GMT m=+0.077087668
* Request to https://api.github.com/graphql
> POST /graphql HTTP/1.1
> Host: api.github.com
> Accept: application/vnd.github.merge-info-preview+json, application/vnd.github.nebula-preview
> Authorization: token ████████████████████
> Content-Length: 121
> Content-Type: application/json
> Graphql-Features: merge_queue
> Time-Zone: Europe/London
> User-Agent: GitHub CLI 2.39.1
> X-Gh-Cache-Ttl: 24h0m0s

{
  "query": "query PullRequest_fields2{WorkflowRun: __type(name: \"WorkflowRun\"){fields(includeDeprecated: true){name}}}"
}

< HTTP/2.0 200 OK
< Access-Control-Allow-Origin: *
< Access-Control-Expose-Headers: ETag, Link, Location, Retry-After, X-GitHub-OTP, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Used, X-RateLimit-Resource, X-RateLimit-Reset, X-OAuth-Scopes, X-Accepted-OAuth-Scopes, X-Poll-Interval, X-GitHub-Media-Type, X-GitHub-SSO, X-GitHub-Request-Id, Deprecation, Sunset
< Content-Security-Policy: default-src 'none'
< Content-Type: application/json; charset=utf-8
< Date: Wed, 29 Nov 2023 17:39:03 GMT
< Github-Authentication-Token-Expiration: 2024-01-01 00:00:00 +0000
< Referrer-Policy: origin-when-cross-origin, strict-origin-when-cross-origin
< Server: GitHub.com
< Strict-Transport-Security: max-age=31536000; includeSubdomains; preload
< Vary: Accept-Encoding, Accept, X-Requested-With
< X-Content-Type-Options: nosniff
< X-Frame-Options: deny
< X-Github-Media-Type: github.merge-info-preview; param=nebula-preview; format=json
< X-Github-Request-Id: E3DC:1938:1A438C57:1A93F457:65677736
< X-Ratelimit-Limit: 5000
< X-Ratelimit-Remaining: 4998
< X-Ratelimit-Reset: 1701283132
< X-Ratelimit-Resource: graphql
< X-Ratelimit-Used: 2
< X-Xss-Protection: 0

{
  "data": {
    "WorkflowRun": {
      "fields": [
        {
          "name": "checkSuite"
        },
        {
          "name": "createdAt"
        },
        {
          "name": "databaseId"
        },
        {
          "name": "deploymentReviews"
        },
        {
          "name": "event"
        },
        {
          "name": "file"
        },
        {
          "name": "id"
        },
        {
          "name": "pendingDeploymentRequests"
        },
        {
          "name": "resourcePath"
        },
        {
          "name": "runNumber"
        },
        {
          "name": "updatedAt"
        },
        {
          "name": "url"
        },
        {
          "name": "workflow"
        }
      ]
    }
  }
}

* Request took 573.25µs
* Request at 2023-11-29 17:43:25.912916 +0000 GMT m=+0.107425585
* Request to https://api.github.com/graphql
> POST /graphql HTTP/1.1
> Host: api.github.com
> Accept: application/vnd.github.merge-info-preview+json, application/vnd.github.nebula-preview
> Authorization: token ████████████████████
> Content-Length: 424
> Content-Type: application/json; charset=utf-8
> Graphql-Features: merge_queue
> Time-Zone: Europe/London
> User-Agent: GitHub CLI 2.39.1

GraphQL query:
query PullRequestByNumber($owner: String!, $repo: String!, $pr_number: Int!) {
    repository(owner: $owner, name: $repo) {
      pullRequest(number: $pr_number) {id,number,state,title,commits(last:1){nodes{commit{oid}}},mergeStateStatus,headRepositoryOwner{id,login,...on User{name}},headRefName,baseRefName,headRefOid}
    }
  }
GraphQL variables: {"owner":"REDACTED","pr_number":397,"repo":"REDACTED"}

⣽< HTTP/2.0 200 OK
< Access-Control-Allow-Origin: *
< Access-Control-Expose-Headers: ETag, Link, Location, Retry-After, X-GitHub-OTP, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Used, X-RateLimit-Resource, X-RateLimit-Reset, X-OAuth-Scopes, X-Accepted-OAuth-Scopes, X-Poll-Interval, X-GitHub-Media-Type, X-GitHub-SSO, X-GitHub-Request-Id, Deprecation, Sunset
< Content-Security-Policy: default-src 'none'
< Content-Type: application/json; charset=utf-8
< Date: Wed, 29 Nov 2023 17:43:28 GMT
< Github-Authentication-Token-Expiration: 2024-01-01 00:00:00 +0000
< Referrer-Policy: origin-when-cross-origin, strict-origin-when-cross-origin
< Server: GitHub.com
< Strict-Transport-Security: max-age=31536000; includeSubdomains; preload
< Vary: Accept-Encoding, Accept, X-Requested-With
< X-Content-Type-Options: nosniff
< X-Frame-Options: deny
< X-Github-Media-Type: github.merge-info-preview; param=nebula-preview; format=json
< X-Github-Request-Id: E417:D807:28C144F:292222A:65677840
< X-Ratelimit-Limit: 5000
< X-Ratelimit-Remaining: 4992
< X-Ratelimit-Reset: 1701283132
< X-Ratelimit-Resource: graphql
< X-Ratelimit-Used: 8
< X-Xss-Protection: 0

{
  "data": {
    "repository": {
      "pullRequest": {
        "id": "REDACTED",
        "number": 397,
        "state": "OPEN",
        "title": "REDACTED",
        "commits": {
          "nodes": [
            {
              "commit": {
                "oid": "2af160f09643c56b33a505bea9590748b96b6250"
              }
            }
          ]
        },
        "mergeStateStatus": "CLEAN",
        "headRepositoryOwner": {
          "id": "REDACTED",
          "login": "REDACTED"
        },
        "headRefName": "REDACTED",
        "baseRefName": "develop",
        "headRefOid": "2af160f09643c56b33a505bea9590748b96b6250"
      }
    }
  }
}

* Request took 3.054969333s
[git rev-parse --verify refs/heads/REDACTED]
* Request at 2023-11-29 17:43:29.019525 +0000 GMT m=+3.214018210
* Request to https://api.github.com/graphql
> POST /graphql HTTP/1.1
> Host: api.github.com
> Accept: application/vnd.github.merge-info-preview+json, application/vnd.github.nebula-preview
> Authorization: token ████████████████████
> Content-Length: 525
> Content-Type: application/json; charset=utf-8
> Graphql-Features: merge_queue
> Time-Zone: Europe/London
> User-Agent: GitHub CLI 2.39.1

GraphQL query:
fragment repo on Repository {
    id
    name
    owner { login }
    hasIssuesEnabled
    description
    hasWikiEnabled
    viewerPermission
    defaultBranchRef {
      name
    }
  }

  query RepositoryInfo($owner: String!, $name: String!) {
    repository(owner: $owner, name: $name) {
      ...repo
      parent {
        ...repo
      }
      mergeCommitAllowed
      rebaseMergeAllowed
      squashMergeAllowed
    }
  }
GraphQL variables: {"name":"REDACTED","owner":"REDACTED"}

< HTTP/2.0 200 OK
< Access-Control-Allow-Origin: *
< Access-Control-Expose-Headers: ETag, Link, Location, Retry-After, X-GitHub-OTP, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Used, X-RateLimit-Resource, X-RateLimit-Reset, X-OAuth-Scopes, X-Accepted-OAuth-Scopes, X-Poll-Interval, X-GitHub-Media-Type, X-GitHub-SSO, X-GitHub-Request-Id, Deprecation, Sunset
< Content-Security-Policy: default-src 'none'
< Content-Type: application/json; charset=utf-8
< Date: Wed, 29 Nov 2023 17:43:29 GMT
< Github-Authentication-Token-Expiration: 2024-01-01 00:00:00 +0000
< Referrer-Policy: origin-when-cross-origin, strict-origin-when-cross-origin
< Server: GitHub.com
< Strict-Transport-Security: max-age=31536000; includeSubdomains; preload
< Vary: Accept-Encoding, Accept, X-Requested-With
< X-Content-Type-Options: nosniff
< X-Frame-Options: deny
< X-Github-Media-Type: github.merge-info-preview; param=nebula-preview; format=json
< X-Github-Request-Id: E417:D807:28C1798:2922580:65677840
< X-Ratelimit-Limit: 5000
< X-Ratelimit-Remaining: 4991
< X-Ratelimit-Reset: 1701283132
< X-Ratelimit-Resource: graphql
< X-Ratelimit-Used: 9
< X-Xss-Protection: 0

{
  "data": {
    "repository": {
      "id": "REDACTED",
      "name": "REDACTED",
      "owner": {
        "login": "REDACTED"
      },
      "hasIssuesEnabled": true,
      "description": "REDACTED",
      "hasWikiEnabled": true,
      "viewerPermission": "WRITE",
      "defaultBranchRef": {
        "name": "develop"
      },
      "parent": null,
      "mergeCommitAllowed": true,
      "rebaseMergeAllowed": false,
      "squashMergeAllowed": true
    }
  }
}

* Request took 467.737083ms
? What merge method would you like to use? Squash and merge
? Delete the branch on GitHub? No
? What's next? Submit
* Request at 2023-11-29 17:43:43.535159 +0000 GMT m=+17.729572126
* Request to https://api.github.com/graphql
> POST /graphql HTTP/1.1
> Host: api.github.com
> Accept: application/vnd.github.merge-info-preview+json, application/vnd.github.nebula-preview
> Authorization: token ████████████████████
> Content-Length: 205
> Content-Type: application/json
> Graphql-Features: merge_queue
> Time-Zone: Europe/London
> User-Agent: GitHub CLI 2.39.1

GraphQL query:
mutation PullRequestMerge($input:MergePullRequestInput!){mergePullRequest(input: $input){clientMutationId}}
GraphQL variables: {"input":{"pullRequestId":"REDACTED","mergeMethod":"SQUASH"}}

< HTTP/2.0 200 OK
< Access-Control-Allow-Origin: *
< Access-Control-Expose-Headers: ETag, Link, Location, Retry-After, X-GitHub-OTP, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Used, X-RateLimit-Resource, X-RateLimit-Reset, X-OAuth-Scopes, X-Accepted-OAuth-Scopes, X-Poll-Interval, X-GitHub-Media-Type, X-GitHub-SSO, X-GitHub-Request-Id, Deprecation, Sunset
< Content-Security-Policy: default-src 'none'
< Content-Type: application/json; charset=utf-8
< Date: Wed, 29 Nov 2023 17:43:44 GMT
< Github-Authentication-Token-Expiration: 2024-01-01 00:00:00 +0000
< Referrer-Policy: origin-when-cross-origin, strict-origin-when-cross-origin
< Server: GitHub.com
< Strict-Transport-Security: max-age=31536000; includeSubdomains; preload
< Vary: Accept-Encoding, Accept, X-Requested-With
< X-Content-Type-Options: nosniff
< X-Frame-Options: deny
< X-Github-Media-Type: github.merge-info-preview; param=nebula-preview; format=json
< X-Github-Request-Id: E417:D807:28C4CFE:2925B79:65677841
< X-Ratelimit-Limit: 5000
< X-Ratelimit-Remaining: 4990
< X-Ratelimit-Reset: 1701283132
< X-Ratelimit-Resource: graphql
< X-Ratelimit-Used: 10
< X-Xss-Protection: 0

{
  "data": {
    "mergePullRequest": null
  },
  "errors": [
    {
      "type": "UNPROCESSABLE",
      "path": [
        "mergePullRequest"
      ],
      "locations": [
        {
          "line": 1,
          "column": 58
        }
      ],
      "message": "Changes must be made through the merge queue"
    }
  ]
}

* Request took 941.228167ms
GraphQL: Changes must be made through the merge queue (mergePullRequest)

@mhemmings
Copy link
Author

Seems to be calling the incorrect API? Should be calling enqueuePullRequest?

@williammartin
Copy link
Member

Definitely something funky about those requests and responses, they are missing fields relating to the merge queue which would result in the CLI determining the right course of action. Will look into this more tomorrow!

@tyrone-anz
Copy link

@williammartin Any update? I am getting this error also for a token. Using SSH key however is okay.

@jsdalton
Copy link

jsdalton commented Dec 8, 2023

We're seeing the same issue in the context of a Github action, which does some auto merging for us. It's in a public repository -- here's a link to the failing job with error message: https://github.com/contentful/marketplace-partner-apps/actions/runs/7136977689/job/19436248905?pr=567

 gh pr merge --delete-branch "--$merge_method" --auto https://github.com/contentful/marketplace-partner-apps/pull/567
  shell: /usr/bin/bash --noprofile --norc -e -o pipefail {0}
  env:
    GITHUB_TOKEN: ***
Auto merging PR using method squash
GraphQL: Changes must be made through the merge queue (mergePullRequest)

(EDIT: I realize that the main issue description claims this is only an issue with PATs, but we're seeing exactly the issue in the context of a Github Action with a GITHUB_TOKEN, as you can see.)

@williammartin
Copy link
Member

Sorry folks, I was really focused on getting the multi account support out this week and everything else fell by the wayside. I'll make an effort to prioritise this.

@williammartin
Copy link
Member

williammartin commented Dec 11, 2023

Here's what output looks like for a PR of mine that went through merge queue:

➜  test-repo git:(triage-merge-queue) GH_DEBUG=api GITHUB_TOKEN=<MY PAT> gh pr merge --auto https://github.com/williammartin-test-org/test-repo/pull/30
* Request at 2023-12-11 12:21:29.849678 +0100 CET m=+0.030893918
* Request to https://api.github.com/graphql
> POST /graphql HTTP/1.1
> Host: api.github.com
⣾> Accept: application/vnd.github.merge-info-preview+json, application/vnd.github.nebula-preview
> Authorization: token ████████████████████
> Content-Length: 121
> Content-Type: application/json
> Graphql-Features: merge_queue
> Time-Zone: Europe/Amsterdam
> User-Agent: GitHub CLI 2.40.0
> X-Gh-Cache-Ttl: 24h0m0s

* Request at 2023-12-11 12:21:29.850084 +0100 CET m=+0.031299876
* Request to https://api.github.com/graphql
> POST /graphql HTTP/1.1
> Host: api.github.com
> Accept: application/vnd.github.merge-info-preview+json, application/vnd.github.nebula-preview
> Authorization: token ████████████████████
> Content-Length: 248
> Content-Type: application/json
> Graphql-Features: merge_queue
> Time-Zone: Europe/Amsterdam
> User-Agent: GitHub CLI 2.40.0
> X-Gh-Cache-Ttl: 24h0m0s

{
  "query": "query PullRequest_fields2{WorkflowRun: __type(name: \"WorkflowRun\"){fields(includeDeprecated: true){name}}}"
}

{
  "query": "query PullRequest_fields{PullRequest: __type(name: \"PullRequest\"){fields(includeDeprecated: true){name}},StatusCheckRollupContextConnection: __type(name: \"StatusCheckRollupContextConnection\"){fields(includeDeprecated: true){name}}}"
}

< HTTP/2.0 200 OK
< Access-Control-Allow-Origin: *
< Access-Control-Expose-Headers: ETag, Link, Location, Retry-After, X-GitHub-OTP, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Used, X-RateLimit-Resource, X-RateLimit-Reset, X-OAuth-Scopes, X-Accepted-OAuth-Scopes, X-Poll-Interval, X-GitHub-Media-Type, X-GitHub-SSO, X-GitHub-Request-Id, Deprecation, Sunset
< Content-Security-Policy: default-src 'none'
< HTTP/2.0 200 OK
< Access-Control-Allow-Origin: *
< Access-Control-Expose-Headers: ETag, Link, Location, Retry-After, X-GitHub-OTP, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Used, X-RateLimit-Resource, X-RateLimit-Reset, X-OAuth-Scopes, X-Accepted-OAuth-Scopes, X-Poll-Interval, X-GitHub-Media-Type, X-GitHub-SSO, X-GitHub-Request-Id, Deprecation, Sunset
< Content-Security-Policy: default-src 'none'
< Content-Type: application/json; charset=utf-8
< Date: Mon, 11 Dec 2023 10:42:59 GMT
< Content-Type: application/json; charset=utf-8
< Date: Mon, 11 Dec 2023 10:42:59 GMT
< Github-Authentication-Token-Expiration: 2024-01-10 11:41:19 +0100
< Github-Authentication-Token-Expiration: 2024-01-10 11:41:19 +0100
< Referrer-Policy: origin-when-cross-origin, strict-origin-when-cross-origin
< Server: GitHub.com
< Strict-Transport-Security: max-age=31536000; includeSubdomains; preload
< Vary: Accept-Encoding, Accept, X-Requested-With
< Referrer-Policy: origin-when-cross-origin, strict-origin-when-cross-origin
< Server: GitHub.com
< Strict-Transport-Security: max-age=31536000; includeSubdomains; preload
< Vary: Accept-Encoding, Accept, X-Requested-With
< X-Content-Type-Options: nosniff
< X-Content-Type-Options: nosniff
< X-Frame-Options: deny
< X-Github-Media-Type: github.merge-info-preview; param=nebula-preview; format=json
< X-Github-Request-Id: F32A:1AFBF3:297EF4F:2A165BD:6576E7B3
< X-Ratelimit-Limit: 5000
< X-Ratelimit-Remaining: 4991
< X-Frame-Options: deny
< X-Github-Media-Type: github.merge-info-preview; param=nebula-preview; format=json
< X-Github-Request-Id: F32A:1AFBF3:297EF4F:2A165BC:6576E7B3
< X-Ratelimit-Limit: 5000
< X-Ratelimit-Remaining: 4992
< X-Ratelimit-Reset: 1702294741
< X-Ratelimit-Reset: 1702294741
< X-Ratelimit-Resource: graphql
< X-Ratelimit-Used: 9
< X-Xss-Protection: 0

< X-Ratelimit-Resource: graphql
< X-Ratelimit-Used: 8
< X-Xss-Protection: 0

{
  "data": {
    "WorkflowRun": {
      "fields": [
        {
          "name": "checkSuite"
        },
        {
          "name": "createdAt"
        },
        {
          "name": "databaseId"
        },
        {
          "name": "deploymentReviews"
        },
        {
          "name": "event"
        },
        {
          "name": "file"
        },
        {
          "name": "id"
        },
        {
          "name": "pendingDeploymentRequests"
        },
        {
          "name": "resourcePath"
        },
        {
          "name": "runNumber"
        },
        {
          "name": "updatedAt"
        },
        {
          "name": "url"
        },
        {
          "name": "workflow"
        }
      ]
    }
  }
}

* Request took 1.130583ms
{
  "data": {
    "PullRequest": {
      "fields": [
        {
          "name": "activeLockReason"
        },
        {
          "name": "additions"
        },
        {
          "name": "assignees"
        },
        {
          "name": "author"
        },
        {
          "name": "authorAssociation"
        },
        {
          "name": "autoMergeRequest"
        },
        {
          "name": "baseRef"
        },
        {
          "name": "baseRefName"
        },
        {
          "name": "baseRefOid"
        },
        {
          "name": "baseRepository"
        },
        {
          "name": "body"
        },
        {
          "name": "bodyHTML"
        },
        {
          "name": "bodyText"
        },
        {
          "name": "canBeRebased"
        },
        {
          "name": "changedFiles"
        },
        {
          "name": "checksResourcePath"
        },
        {
          "name": "checksUrl"
        },
        {
          "name": "closed"
        },
        {
          "name": "closedAt"
        },
        {
          "name": "closingIssuesReferences"
        },
        {
          "name": "comments"
        },
        {
          "name": "commits"
        },
        {
          "name": "createdAt"
        },
        {
          "name": "createdViaEmail"
        },
        {
          "name": "databaseId"
        },
        {
          "name": "deletions"
        },
        {
          "name": "editor"
        },
        {
          "name": "files"
        },
        {
          "name": "headRef"
        },
        {
          "name": "headRefName"
        },
        {
          "name": "headRefOid"
        },
        {
          "name": "headRepository"
        },
        {
          "name": "headRepositoryOwner"
        },
        {
          "name": "hovercard"
        },
        {
          "name": "id"
        },
        {
          "name": "includesCreatedEdit"
        },
        {
          "name": "isCrossRepository"
        },
        {
          "name": "isDraft"
        },
        {
          "name": "isInMergeQueue"
        },
        {
          "name": "isMergeQueueEnabled"
        },
        {
          "name": "isReadByViewer"
        },
        {
          "name": "labels"
        },
        {
          "name": "lastEditedAt"
        },
        {
          "name": "latestOpinionatedReviews"
        },
        {
          "name": "latestReviews"
        },
        {
          "name": "locked"
        },
        {
          "name": "maintainerCanModify"
        },
        {
          "name": "mergeCommit"
        },
        {
          "name": "mergeQueue"
        },
        {
          "name": "mergeQueueEntry"
        },
        {
          "name": "mergeStateStatus"
        },
        {
          "name": "mergeable"
        },
        {
          "name": "merged"
        },
        {
          "name": "mergedAt"
        },
        {
          "name": "mergedBy"
        },
        {
          "name": "milestone"
        },
        {
          "name": "number"
        },
        {
          "name": "participants"
        },
        {
          "name": "permalink"
        },
        {
          "name": "potentialMergeCommit"
        },
        {
          "name": "projectCards"
        },
        {
          "name": "projectItems"
        },
        {
          "name": "projectV2"
        },
        {
          "name": "projectsV2"
        },
        {
          "name": "publishedAt"
        },
        {
          "name": "reactionGroups"
        },
        {
          "name": "reactions"
        },
        {
          "name": "repository"
        },
        {
          "name": "resourcePath"
        },
        {
          "name": "revertResourcePath"
        },
        {
          "name": "revertUrl"
        },
        {
          "name": "reviewDecision"
        },
        {
          "name": "reviewRequests"
        },
        {
          "name": "reviewThreads"
        },
        {
          "name": "reviews"
        },
        {
          "name": "state"
        },
        {
          "name": "suggestedReviewers"
        },
        {
          "name": "timeline"
        },
        {
          "name": "timelineItems"
        },
        {
          "name": "title"
        },
        {
          "name": "titleHTML"
        },
        {
          "name": "totalCommentsCount"
        },
        {
          "name": "updatedAt"
        },
        {
          "name": "url"
        },
        {
          "name": "userContentEdits"
        },
        {
          "name": "viewerCanAddAndRemoveFromMergeQueue"
        },
        {
          "name": "viewerCanApplySuggestion"
        },
        {
          "name": "viewerCanClose"
        },
        {
          "name": "viewerCanDeleteHeadRef"
        },
        {
          "name": "viewerCanDisableAutoMerge"
        },
        {
          "name": "viewerCanEditFiles"
        },
        {
          "name": "viewerCanEnableAutoMerge"
        },
        {
          "name": "viewerCanMergeAsAdmin"
        },
        {
          "name": "viewerCanReact"
        },
        {
          "name": "viewerCanReopen"
        },
        {
          "name": "viewerCanSubscribe"
        },
        {
          "name": "viewerCanUpdate"
        },
        {
          "name": "viewerCanUpdateBranch"
        },
        {
          "name": "viewerCannotUpdateReasons"
        },
        {
          "name": "viewerDidAuthor"
        },
        {
          "name": "viewerLatestReview"
        },
        {
          "name": "viewerLatestReviewRequest"
        },
        {
          "name": "viewerMergeBodyText"
        },
        {
          "name": "viewerMergeHeadlineText"
        },
        {
          "name": "viewerSubscription"
        }
      ]
    },
    "StatusCheckRollupContextConnection": {
      "fields": [
        {
          "name": "checkRunCount"
        },
        {
          "name": "checkRunCountsByState"
        },
        {
          "name": "edges"
        },
        {
          "name": "nodes"
        },
        {
          "name": "pageInfo"
        },
        {
          "name": "statusContextCount"
        },
        {
          "name": "statusContextCountsByState"
        },
        {
          "name": "totalCount"
        }
      ]
    }
  }
}

* Request took 1.756542ms
* Request at 2023-12-11 12:21:29.852086 +0100 CET m=+0.033301918
* Request to https://api.github.com/graphql
> POST /graphql HTTP/1.1
> Host: api.github.com
> Accept: application/vnd.github.merge-info-preview+json, application/vnd.github.nebula-preview
> Authorization: token ████████████████████
> Content-Length: 466
> Content-Type: application/json; charset=utf-8
> Graphql-Features: merge_queue
> Time-Zone: Europe/Amsterdam
> User-Agent: GitHub CLI 2.40.0

GraphQL query:
query PullRequestByNumber($owner: String!, $repo: String!, $pr_number: Int!) {
    repository(owner: $owner, name: $repo) {
      pullRequest(number: $pr_number) {id,number,state,title,commits(last:1){nodes{commit{oid}}},mergeStateStatus,headRepositoryOwner{id,login,...on User{name}},headRefName,baseRefName,headRefOid,isInMergeQueue,isMergeQueueEnabled}
    }
  }
GraphQL variables: {"owner":"williammartin-test-org","pr_number":30,"repo":"test-repo"}

⣟< HTTP/2.0 200 OK
< Access-Control-Allow-Origin: *
< Access-Control-Expose-Headers: ETag, Link, Location, Retry-After, X-GitHub-OTP, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Used, X-RateLimit-Resource, X-RateLimit-Reset, X-OAuth-Scopes, X-Accepted-OAuth-Scopes, X-Poll-Interval, X-GitHub-Media-Type, X-GitHub-SSO, X-GitHub-Request-Id, Deprecation, Sunset
< Content-Security-Policy: default-src 'none'
< Content-Type: application/json; charset=utf-8
< Date: Mon, 11 Dec 2023 11:21:30 GMT
< Github-Authentication-Token-Expiration: 2024-01-10 11:41:19 +0100
< Referrer-Policy: origin-when-cross-origin, strict-origin-when-cross-origin
< Server: GitHub.com
< Strict-Transport-Security: max-age=31536000; includeSubdomains; preload
< Vary: Accept-Encoding, Accept, X-Requested-With
< X-Content-Type-Options: nosniff
< X-Frame-Options: deny
< X-Github-Media-Type: github.merge-info-preview; param=nebula-preview; format=json
< X-Github-Request-Id: F453:137A0A:28BAA72:2951457:6576F0B9
< X-Ratelimit-Limit: 5000
< X-Ratelimit-Remaining: 4982
< X-Ratelimit-Reset: 1702294741
< X-Ratelimit-Resource: graphql
< X-Ratelimit-Used: 18
< X-Xss-Protection: 0

{
  "data": {
    "repository": {
      "pullRequest": {
        "id": "PR_kwDOJgN1OM5hq3KJ",
        "number": 30,
        "state": "OPEN",
        "title": "triage merge queue",
        "commits": {
          "nodes": [
            {
              "commit": {
                "oid": "57d6031dd8182b8b2e9d929938658c2979e584d7"
              }
            }
          ]
        },
        "mergeStateStatus": "CLEAN",
        "headRepositoryOwner": {
          "id": "O_kgDOB-vozA",
          "login": "williammartin-test-org"
        },
        "headRefName": "triage-merge-queue",
        "baseRefName": "main",
        "headRefOid": "57d6031dd8182b8b2e9d929938658c2979e584d7",
        "isInMergeQueue": false,
        "isMergeQueueEnabled": true
      }
    }
  }
}

* Request took 647.90475ms
[git rev-parse --verify refs/heads/triage-merge-queue]
* Request at 2023-12-11 12:21:30.519185 +0100 CET m=+0.700407459
* Request to https://api.github.com/graphql
> POST /graphql HTTP/1.1
> Host: api.github.com
> Accept: application/vnd.github.merge-info-preview+json, application/vnd.github.nebula-preview
> Authorization: token ████████████████████
> Content-Length: 228
> Content-Type: application/json
> Graphql-Features: merge_queue
> Time-Zone: Europe/Amsterdam
> User-Agent: GitHub CLI 2.40.0

GraphQL query:
mutation PullRequestAutoMerge($input:EnablePullRequestAutoMergeInput!){enablePullRequestAutoMerge(input: $input){clientMutationId}}
GraphQL variables: {"input":{"pullRequestId":"PR_kwDOJgN1OM5hq3KJ","mergeMethod":"MERGE"}}

< HTTP/2.0 200 OK
< Access-Control-Allow-Origin: *
< Access-Control-Expose-Headers: ETag, Link, Location, Retry-After, X-GitHub-OTP, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Used, X-RateLimit-Resource, X-RateLimit-Reset, X-OAuth-Scopes, X-Accepted-OAuth-Scopes, X-Poll-Interval, X-GitHub-Media-Type, X-GitHub-SSO, X-GitHub-Request-Id, Deprecation, Sunset
< Content-Security-Policy: default-src 'none'
< Content-Type: application/json; charset=utf-8
< Date: Mon, 11 Dec 2023 11:21:31 GMT
< Github-Authentication-Token-Expiration: 2024-01-10 11:41:19 +0100
< Referrer-Policy: origin-when-cross-origin, strict-origin-when-cross-origin
< Server: GitHub.com
< Strict-Transport-Security: max-age=31536000; includeSubdomains; preload
< Vary: Accept-Encoding, Accept, X-Requested-With
< X-Content-Type-Options: nosniff
< X-Frame-Options: deny
< X-Github-Media-Type: github.merge-info-preview; param=nebula-preview; format=json
< X-Github-Request-Id: F453:137A0A:28BAE27:295180E:6576F0BA
< X-Ratelimit-Limit: 5000
< X-Ratelimit-Remaining: 4981
< X-Ratelimit-Reset: 1702294741
< X-Ratelimit-Resource: graphql
< X-Ratelimit-Used: 19
< X-Xss-Protection: 0

{
  "data": {
    "enablePullRequestAutoMerge": {
      "clientMutationId": null
    }
  }
}

* Request took 834.585167ms
✓ Pull request #30 will be added to the merge queue for main when ready

The relevant difference here from your output are the fields: isInMergeQueue and isMergeQueueEnabled in response to PullRequest_fields. The presence of these fields are used to indicate to gh how to handle the merge queue interactions for a PR. In your case, they are absent.

I created a PAT here with what I think are matching scopes for yours:

Image

Image

@williammartin
Copy link
Member

@mhemmings I'm sure you've looked at this but I would be remiss not to be absolutely certain. Can you double check:

  • that you have exactly the permissions from my previous comment
  • that they apply to the repository you are merging this PR for
  • that you are definitely using that PAT on the gh pr merge command by setting GITHUB_TOKEN=<YOUR PAT> gh pr merge ...

In the meantime I'll think about what other differences there could be here.

@williammartin
Copy link
Member

@jsdalton, I'm not sure but I suspect that something in your workflow permissions needs to be changed.

Since @mhemmings has this working in Actions, perhaps they can share the permissions they have set?

@mhemmings
Copy link
Author

@williammartin Permissions are the same as yours (see screenshot below) and apply to the repo being merged.

I'm fairly confident the PAT was used correctly, but I will do a full test again today to confirm.

Screenshot 2023-12-11 at 11 28 41

@williammartin
Copy link
Member

Thanks, I know it feels like first line tech support help but given that it worked for me I really don't want to go down a rabbit hole only to discover it was something simple. 🙏

@williammartin
Copy link
Member

To try and recreate, can you tell me any more about the PAT, for example:

  • When was it created?
  • Does it have any org permissions?
  • Is it scoped to All Repos or only Select Repos?

@mhemmings
Copy link
Author

  • It's a fine-grained access token
  • For a user thats inside a group with write permissions to the repo
  • Was created 23 days ago
  • Read access to metadata
  • Read and Write access to code, merge queues, and pull requests
  • Scoped to just the repo needed here
  • No org permissions
  • Can be successfully used to add PRs to the merge queue when calling the API directly (enqueuePullRequest etc)

@williammartin
Copy link
Member

@mhemmings, I think I've found the issue in the platform that is causing this and seem to be able to reproduce it. Unfortunately, I don't have a great workaround for you right now other than using the enqueue mutation directly.

I'm in discussion with the team that owns this feature to try and get this resolved on their side. As far as I'm concerned everything you've done is correct, the CLI is also doing what it is supposed to, and the platform has some incongruent behaviour.

@williammartin williammartin added platform Problems with the GitHub platform rather than the CLI client p2 Affects more than a few users but doesn't prevent core functions and removed needs-user-input labels Dec 11, 2023
github-merge-queue bot pushed a commit to contentful/marketplace-partner-apps that referenced this issue Dec 11, 2023
## Purpose

Per discussion in this thread cli/cli#8352 the
issue with our dependabot approve and merge might be that it lacks
correct permissions.

## Approach

* Try adding pull-request permission. See here
https://docs.github.com/en/actions/using-jobs/assigning-permissions-to-jobs

## Testing steps

<!-- Do you have a happy path a user would run through to test this app
or would help the reviewer get started bug testing -->

## Breaking Changes

<!-- Are there any changes to be aware of that would break current
production build? -->

## Dependencies and/or References

<!-- Where can we get more insights about this change? (Tickets, wiki
pages or links to other places/docs -- no private/internal links please)
-->

## Deployment

<!-- (Optional) Are there any deployment-related tasks, concerns or
risks we should be mindful of? -->
@jsdalton
Copy link

Thanks @williammartin I appreciate your working on this (and totally understand not wanting to fall down the rabbit hole if it's user error).

To be clear in our use case adding the permission pull-requests: write to the GHA job did not solve the issue https://github.com/contentful/marketplace-partner-apps/actions/runs/7169699697/job/19521057492 . I'm not sure if you already realized this would be the case based on your last message but just wanted to let you know.

Our current permissions are https://github.com/contentful/marketplace-partner-apps/actions/runs/7169699697/workflow#L8-L10

      contents: write
      id-token: write
      pull-requests: write

@williammartin
Copy link
Member

@jsdalton, given that @mhemmings has this working in GitHub Actions, I would expect that it's possible to work there. Was hoping that he could either:

  • Share the permissions used in their workflow
  • Otherwise inform where GITHUB_TOKEN comes from, if it's not the one injected by the actions runner

@jsdalton
Copy link

Thanks for that clarification @williammartin .

The action itself is in a private repository but in this repo it appears we are overriding the GITHUB_TOKEN with a PAT. So I believe that's probably why we're seeing the issue in the context of a GH action. 💡

I'm talking to the team who owns the action about fixing this (the override is unneeded I believe) so hopefully this resolves the issue. If this is indeed the issue on my side then it's further confirmation of the problem with PATs you've already identified.

Thanks again for your active help and feedback here.

@williammartin
Copy link
Member

It's also possible that the reverse is true and @mhemmings is overriding with a PAT that does happen to work. I intend to write this up tomorrow but the gist of it is that in past the CLI had merge queue support for actors that were feature flagged to use it. This feature flag gated both the merge queue functionality and all of the GQL API. However, not all of the GQL API was stabilised so now it's possible to be using the merge queue without being in the feature flag for the unstable API. It's a bit of a mess!

I have ideas on how to move this forward but being realistic, I don't think it would happen before the holidays.

@jsdalton
Copy link

Thanks for the clarity @williammartin. If I learn anything relevant (one way or the other) I'll post my findings here.

lenaschoenburg added a commit to camunda/camunda that referenced this issue Jan 11, 2024
backport-action pushed a commit to camunda/camunda that referenced this issue Jan 11, 2024
backport-action pushed a commit to camunda/camunda that referenced this issue Jan 11, 2024
backport-action pushed a commit to camunda/camunda that referenced this issue Jan 11, 2024
backport-action pushed a commit to camunda/camunda that referenced this issue Jan 11, 2024
ce-dmelnych pushed a commit to camunda/camunda that referenced this issue Jan 18, 2024
@rwong2888
Copy link

any update on this?

@williammartin
Copy link
Member

any update on this?

No. Are you also running into it? Please drop a thumbs up on the original issue to help it stand out in our prioritisation discussions.

@marisbest2
Copy link

marisbest2 commented Jan 30, 2024

I just started running into this just now. A GH workflow that previously was working just stopped working with this issue. I'm able to use the CLI locally successfully, but in the GH Actions workflow it fails.

@rwong2888
Copy link

any update on this?

No. Are you also running into it? Please drop a thumbs up on the original issue to help it stand out in our prioritisation discussions.

Yes, this just started happening the past hour on our side

@williammartin
Copy link
Member

A GH workflow that previously was working just stopped working with this issue.

That's surprising. I can't think of any reason that it would stop working with no change on your end. Did you change the token in any way?

I'm able to use the CLI locally successfully, but in the GH Actions workflow it fails.

That isn't surprising based on #8352 (comment)

@williammartin
Copy link
Member

Yes, this just started happening the past hour on our side

Interesting. Just to check @rwong2888 and @marisbest2 are you in the same organisation?

@marisbest2
Copy link

We are not

@marcelodeaguiar
Copy link

marcelodeaguiar commented Jan 30, 2024

I'm with the same problem here

We are using a classic token with the following permissions

image

@williammartin
Copy link
Member

Thanks all. It seems likely that a change has been shipped in the platform that has caused a regression in the CLI. We are currently investigating.

@dwashko
Copy link

dwashko commented Jan 30, 2024

I just set up a workflow for merging in PR's from dependabot by using a PAT from an admin user for the merge. This was working yesterday and earlier today but stopped working around 2:30 Eastern resulting in the errors reported above:

GraphQL: Field 'isMergeQueueEnabled' doesn't exist on type 'PullRequest' (query PullRequestByNumber.repository.pullRequest.isMergeQueueEnabled)

If I don't use the PAT we run into the branch protection rules that were set up, particularly requiring two approving reviewers.

@williammartin
Copy link
Member

Let's move this conversation over to #8645 which is specifically for the platform change you are all experiencing right now. Updates will be provided over on that issue.

@williammartin
Copy link
Member

@mhemmings, @jsdalton and @tyrone-anz do any of you still experience the original issue? I would expect that this has been resolved after some platform changes.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working p2 Affects more than a few users but doesn't prevent core functions platform Problems with the GitHub platform rather than the CLI client
Projects
None yet
Development

No branches or pull requests

10 participants