Winget automatic release for 0.35 failed

[sophiajt]

Describe the Bug

cc @TechWatching

From the CI:

Manifest saved to D:\a\nushell\nushell\manifests\n\Nushell\Nushell\0.35.0

Manifest validation succeeded: True

Submitting pull request for manifest...

Octokit.ForbiddenException: Must have admin rights to Repository.
   at Octokit.Connection.HandleErrors(IResponse response)
   at Octokit.Connection.RunRequest(IRequest request, CancellationToken cancellationToken)
   at Octokit.Connection.Run[T](IRequest request, CancellationToken cancellationToken)
   at Octokit.Connection.Delete(Uri uri)
   at Microsoft.WingetCreateCore.Common.GitHub.SubmitPRAsync(String packageId, String version, Dictionary`2 contents, Boolean submitToFork)
   at Microsoft.WingetCreateCLI.Commands.BaseCommand.GitHubSubmitManifests(Manifests manifests, String token)
   at Microsoft.WingetCreateCLI.Commands.UpdateCommand.ExecuteManifestUpdate(List`1 latestManifestContent, CommandExecutedEvent commandEvent)
   at Microsoft.WingetCreateCLI.Commands.UpdateCommand.Execute()
   at Microsoft.WingetCreateCLI.Program.Main(String[] args)
{"message":"Must have admin rights to Repository.","documentation_url":"https://docs.github.com/rest/reference/repos#delete-a-repository"}
Error: Process completed with exit code 1.

To Reproduce

Release on CI

Expected behavior

The release action should post to winget repo successfully

Screenshots

No response

Configuration

No response

Additional Context

No response

[TechWatching]

The problem seems to come from the Personal Access Token this time, not the script in itself. From what I understand, the PAT that was generated (whose value is in the secret NUSHELL_PAT) does not have the proper permission.

Just to be sure it was not a problem from winget create I just tried on a private repo and it worked fine: the PR was correctly created as you can see here.

Maybe @jntrnr you can re-generate a PAT with the following permission and set the value of NUSHELL_PAT secret with it:

Once this is done, if you can re-run the job of this workflow to see if that works well it would be great.

[fdncred]

I created the NUSHELL_PAT with public_repo checked. I think that's the way it says to do it in the winget documentation, iirc. We can recreate it and try again though. @jntrnr owns the repo I think so maybe JT can generate the next one.

[TechWatching]

Yes I don't know why this would need the owner of the repo to create the PAT but I have no other idea to make it work. I don't see any difference with what I have done on my nushell fork that could explain the issue.

[sophiajt]

@TechWatching - okay, it should be updated with one of my PATs now

[TechWatching]

@jntrnr Great, can you relaunch the workflow ?
I guess you have a "Re-run jobs" button on the workflow run that failed. I think this should re-run using the updated PAT, well I hope it will so that we do not have to wait for next release.

[sophiajt]

Seems like it needs more in the PAT. @TechWatching was selecting public_repo all you needed?

[sophiajt]

Or maybe it's using the cached one? I guess that's also possible

[TechWatching]

Yes as @fdncred said it is the only permission mentionned by the documentation. And as you can see on my fork this worked well and the PAT I generated only have the public_repo permission.

Maybe it used the cached one. But in that case that means we will have to wait for release 0.36.0 to check that 😕, a bit disappointing a I guess it won't happen soon.

[TechWatching]

Unless you agree to create a 0.36.0 release just to check the triggered workflow to publish to nuget has the correct PAT and that everything work. Not a great idea but as it works on my fork that contain the same exact code for the workflow than on nushell repository, I don't see what else we can do.

I guess we could also enable the logs and add more permissions that needed to the PAT until it work, but I am afraid that won't solve the issue.

[sophiajt]

Sounds like we'll just give it another go in three weeks

[TechWatching]

Okay fine. I am a bit disappointed as this time I was pretty confident that it was going to work but I guess there are always surprises with pipelines, true for Azure Pipelines but it seems also true for GitHub Actions.

In the meantime, I will try to ask on wingetcreate's repo why a PAT from the owner of the repo is needed for wingetcreate to work and if this error has ever happen to someone. Thanks for re-trying though, I hope next time will be the one.

[fdncred]

ya, it stinks @TechWatching . You're trying so hard and we truely appreciate it. Thanks! btw - i am an admin on the repo so it's uber strange if @jntrnr 's works and my pat doesn't. Mine was created like this last time.

[TechWatching]

FYI I created this issue on the winget-create repo.

From what I understood, winget-create update command is using the token to fork the winget-pkgs repository, push a new branch in it with the updated manifest and submit a new PR from this branch.

(this is from my fork, you can see the autogenerated branches by wingetcreate).

On your forks (@fdncred or @jntrnr ) I can't see any auto-generated branch so I guess the push of this autogenerated branch on your fork is failing.

Hence I guess the issue has nothing to do with ownership of Nushell repository as you said Darren but more a problem to push some code to your forks. That does not really help to solve the issue, just to understand what is happening.

[fdncred]

I thought I had deleted my winget repo, I'm guessing it recreated the fork when it was using the PAT i generated. Now that it's using @jntrnr 's his should have the autogenerated one, weird that it does not. One work around is for @TechWatching to give us his PAT that is working and we put it in the repo, although I'm not sure that's a good long term solution.

[TechWatching]

I deleted all my PAT and recreated one with only the public_repo permission and replace my secret with this new value just in case.

Everything worked again and a PR was created when I launched a fake release on my nushell fork.

@fdncred Would you mind trying to execute the following commands locally with your PAT in order to check if you have the same issue with your PAT than on the github actions workflow (replace the *** of the token by your PAT value)?

$tagName="0.101.0"
$installerUrl="https://github.com/TechWatching/nushell/releases/download/0.101.0/nu_0_101_0_windows.msi"
$token="*******"
wingetcreate update Nushell.Nushell -s -v $tagName -u $installerUrl -t $token